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RISKY BUSINESS: EXAMINING GAO’S LIST OF 
HIGH-RISK GOVERNMENT PROGRAMS 


WEDNESDAY, FEBRUARY 11, 2015 

U.S. Senate, 

Committee on Homeland Security 
AND Governmental Aefairs, 

Washington, DC. 

The Committee met, pursuant to notice, at 10:03 a.m., in room 
SD-342, Dirksen Senate Office Building, Hon. Ron Johnson, Chair- 
man of the Committee, presiding. 

Present: Senators Johnson, Lankford, Ayotte, Ernst, Sasse, Car- 
per, McCaskill, Baldwin, Heitkamp, and Peters. 

OPENING STATEMENT OF CHAIRMAN JOHNSON 

Chairman JOHNSON. This hearing will come to order. 

I want to welcome everyone. I appreciate my colleagues coming 
here and all the members of the audience and, of course. Comp- 
troller General Eugene Dodaro and other members of the Govern- 
ment Accountability Office (GAO). 

This is an important hearing. There is a reason this is the third 
hearing that we are having in this Congress on this Committee. 
The good work that GAO has done is demonstrated by the fact over 
the last 2 years, just recommendations implemented from previous 
High-Risk Lists have generated $40 billion of savings over the last 
2 years. I mean, that is a remarkable figure. 

Today, we are going to be talking about the update to the list. 
There is some good news. I am happy to report that the Depart- 
ment of Homeland Security (DHS) management has made solid 
progress and there are some prospects of DHS coming off that list. 
We are looking forward to that. There has been progress made in 
terms of the Department of Defense (DOD) contract management, 
progress made with the Food and Drug Administration (FDA’s) 
oversight of medical devices. 

Unfortunately, there has been some expanded scrutiny — tax code 
enforcement and fraud. I appreciate the fact that the GAO is point- 
ing out the fact that cybersecurity is a real issue, a real threat, and 
that is a top priority of this Committee, to start taking pieces of 
legislation or be involved in the passage of legislation that will ad- 
dress the first step in providing some measure of additional 
cybersecurity, and that would be information sharing. So, I appre- 
ciate that. 

I hate to report that there are some new areas added. Informa- 
tion technology (IT) acquisition — that is really not much of a sur- 
prise, but it is very disappointing to hear that Veterans Affairs 

( 1 ) 
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(VA) Health Care, has been added to this, and this hits pretty close 
to home with both Senator Baldwin and myself. 

We have a facility in Tomah. Over the last couple of years, we 
have lost three veterans to the system. Two died with deaths re- 
lated to potential opiate drug over-prescription, and not even a 
month ago, a 74-year-old veteran — I am not a doctor, but pretty ob- 
vious stroke symptoms sat and waited in a waiting room for 3 
hours to be treated, probably had a stroke, was wheeled into an ex- 
amination room, waited another 45 minutes, had a massive stroke, 
was finally ambulanced to a different hospital. The CT scanner was 
apparently not operational, so they could not administer anticoagu- 
lant drugs, and this gentleman died 2 days later. 

So, it is noteworthy to understand that GAO has been making 
recommendations to the Veterans Health Care System for a num- 
ber of years. There are more than 100 recommendations that have 
not been implemented, about 80 percent of the recommendations. 

So, certainly what I would like to get out of this Committee, out 
of this hearing and hopefully out of Committee action, is coming up 
with some kind of method, some kind of control to make sure that 
these good recommendations that save the taxpayer so many dol- 
lars, that could potentially save lives, are actually implemented. I 
mean, that has to be a top priority of this Committee. Let us utilize 
the guidepost of the GAO High-Risk List and the other good work 
they do and let us make sure these recommendations are finally 
implemented at the agency level. It will save money. It will save 
lives. 

So, with that, I would like to turn it over to our Ranking Mem- 
ber, Senator Carper. 

OPENING STATEMENT OF SENATOR CARPER 

Senator Carper. Thank you, Mr. Chairman. Thanks for con- 
vening us today. 

And, to Gene Dodaro and to the many members of your team 
that are in the audience and may be listening or watching outside 
of the building, we want to just say a big thank you to all of them 
for giving us a great to-do list. My wife is a big believer in to-do 
lists, and every morning, I go down to the kitchen and there on the 
island in the kitchen, usually is a to-do list. Sometimes it is for her. 
Sometimes it is for me. And, what you have provided, you and your 
colleagues at GAO have provided us, is an incredibly important to- 
do list, and you do this every 2 years. We take that responsibility 
on your part seriously and we take the responsibility just as seri- 
ously for ourselves. 

It is interesting how you can make progress in addressing any 
number of the areas that need to be addressed within that to-do 
list you are providing for us. We can hold a hearing, and over the 
years, we have been able to make real progress just by scheduling 
a hearing and bringing folks to this table, in some cases, folks who 
are in charge of acquisitions at the Department of Defense for 
weapons systems. Just hold a hearing. In other cases, we send let- 
ters, and they can have an amazing effect. 

We not only will introduce legislation, we will simply call the 
Secretary of the Department or the senior person within the De- 
partment and say, we want to meet with you and here is why. And, 
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you and your team are complicit in a very positive way in all of 
that. 

For those of you who have joined us, we had a press conference 
here early on and I talked about from time to time people say to 
me, “I do not mind paying taxes. I just do not want you to waste 
my money.” I do not want to waste their money, either, and this 
Committee is committed to making sure that we continue to fight. 
It is like whack-a-mole, and the government is so big, and there 
are so many people trying to defraud our government for money. 

I have an entire statement I want to make part of the record, ^ 
but I just want to say, the kind of passion and commitment that 
we have brought to addressing the entire to-do list remains. Tom 
Coburn is gone, but that spirit that he brought to this Committee 
for all those years is still being nurtured by me and, I think, by 
Ron, and by a new Member from Oklahoma. A lot of work to do, 
and we are going to work it together. 

I will say one other thing that I think bears repeating. I am a 
big believer in leverage. When I chaired with Tom and led a Sub- 
committee of this Committee, we tried to be effective in addressing 
waste, fraud and abuse in government, and we found that we could 
be a lot more effective as a Subcommittee or this full Committee 
if we partnered with you and with your team. We found that we 
could be more effective if we would partner with the literally doz- 
ens of Inspector Generals (IGs) across the Federal Government. We 
found that we could be more effective if we would partner with the 
Office of Management and Budget (0MB), with the nonprofit orga- 
nizations that are committed to reducing waste in government, and 
it works. It actually works. 

It is a little bit like changing the course of an air craft carrier, 
but if you stick with it, you do not give up, you can change the 
course of an air craft carrier, and we can change the course of our 
government and improve the service that we provide for the people 
of this country. 

So, we look forward to hearing from you, anxious to watch you 
read your notes yet again — actually, he never reads his notes, and 
is one of the most amazing people I have ever seen testify in the 
Congress. I always say this and hope maybe it will spook him so 
that he will forget where he is. [Laughter.] 

I remember Winston Churchill used to give speeches before the 
House of Parliament and he would, like, memorize his speeches, 
and one day he was giving a speech, a terrific speech — ^you know 
how good he was — and he forgot his speech and he lost his way. 
So, I keep waiting for that to happen with you [Laughter.] 

But I have been calling all these years. Gene, and you never do, 
so I do not want to jinx you today, but thanks very much for being 
here and talking with us and we look forward to this conversation. 

Chairman JOHNSON. That is that accounting background, right? 

I should have mentioned earlier, I do have a formal opening 
statement that I would like to enter into the record.^ Without ob- 
jection, so ordered. 


^The prepared statement of Senator Carper appears in the Appendix on page 40. 

2 The prepared statement of Senator Johnson appears in the Appendix on page 39. 
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It is the tradition of this Committee to swear in witnesses, so Mr. 
Dodaro and any other GAO employees that might assist in the tes- 
timony, please rise. Raise your right hand. 

Do you swear the testimony you will give before this Committee 
will be the truth, the whole truth, and nothing but the truth, so 
help you, God? 

Mr. Dodaro. I do. 

Ms. Bascetta. I do. 

Ms. Draper. I do. 

Mr. Herr. I do. 

Mr. Maurer. I do. 

Mr. Mihm. I do. 

Mr. PowNER. I do. 

Mr. White. I do. 

Mr. WiLSHUSEN. I do. 

Chairman JOHNSON. Please be seated. Mr. Dodaro. 

TESTIMONY OF HON. EUGENE L. DODAROJ COMPTROLLER 
GENERAL OF THE UNITED STATES, U.S. GOVERNMENT AC- 
COUNTABILITY OFFICE; ACCOMPANIED BY CYNTHIA 
BASCETTA, MANAGING DIRECTOR, HEALTH CARE; DEBRA A. 
DRAPER, DIRECTOR, HEALTH CARE; PHILLIP HERR, DIREC- 
TOR, PHYSICAL INFRASTRUCTURE ISSUES; DAVID MAURER, 
DIRECTOR, HOMELAND SECURITY AND JUSTICE; J. CHRIS- 
TOPHER MIHM, MANAGING DIRECTOR, STRATEGIC ISSUES; 
DAVID A. POWNER, DIRECTOR, INFORMATION TECHNOLOGY; 
JAMES WHITE, DIRECTOR, STRATEGIC ISSUES; AND GREG- 
ORY WILSHUSEN, DIRECTOR, INFORMATION TECHNOLOGY 

Mr. Dodaro. Thank you very much, Mr. Chairman. Good morn- 
ing to you. Ranking Member Senator Carper, and Members of the 
Committee. I am very pleased to be here today to discuss the up- 
date to GAO’s High-Risk List. 

We provide this update with the beginning of each new Congress 
to help the Congress set its priorities for oversight and to help the 
Administration focus on areas that we consider to be of highest risk 
for either fraud, waste, abuse, or mismanagement, or in need of 
broad-based transformation across the government. 

This year, we are reporting solid, steady progress in the vast ma- 
jority of the High-Risk Areas that we have had on the list to date. 
We are also providing ratings for the first time against each High- 
Risk Area’s status and progress getting off the list. 

In order to get off the list, High-Risk Areas need to meet five cri- 
teria. They need to have top leadership commitment. They need to 
have the capacity, the resources, and the people with the right 
skills to get off the list. They have to have a good corrective action 
plan that goes to the root cause of the problems. They have to have 
a monitoring effort with interim milestones and metrics to make 
sure they are making progress. And then they have to demonstrate 
that they are actually beginning to fix the problem. They do not 
have to have it 100 percent fixed to get off the list, but they have 
to have tangible progress that they are on the right path and are 
actually fixing the problem. 


^The prepared statement of Mr. Dodaro appears in the Appendix on page 43. 
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Now, of the 30 areas that were on the list based on our last up- 
date, 18 of those areas have at least partially met each of the five 
criteria for coming off the list. Eleven of those areas have fully met 
at least one or more of the criteria and partially met the others. 
So, there is good, steady progress as we report. 

In two areas, we report enough progress that we are actually 
narrowing the scope of the High-Risk Area. First, in FDA’s over- 
sight of medical devices, in the area of recalls, we were concerned 
that they were not consistently applying recall criteria, actually en- 
suring that the recalls were effective, and did not analyze recall 
data over time to identify potential trends that warranted some 
alerts to the industry. They are now doing that. They have ana- 
lyzed 10 years of data. They are ensuring greater consistency in 
having recalls. They are documenting whether the recalls have oc- 
curred and were effective. 

And, also, we have seen progress in their ability to process new 
device requests. In the past, they were slow to implement legisla- 
tion that provided a dual-track process where certain devices that 
were similar to those on the market could go to an expedited re- 
view, but new devices that passed the highest risks needed to go 
through a more stringent review. They were slow to implement the 
Act. They have now corrected that and they are on track to imple- 
ment the legislation by this year. 

They still have issues in ensuring the adequacy and the safety 
of medical products and devices in a global marketplace. Right 
now, 80 percent of the active ingredients for prescription drugs, 40 
percent of finished drugs, and about half of medical devices come 
from about 150 countries around the world. So we have encouraged 
them to move from an oversight process focused on overseeing do- 
mestic production to overseeing what is now a global marketplace 
for drugs and devices, and also to focus on drug shortages. They 
still have work to do in that area, and many of these are life-sus- 
taining and life-saving drugs that are of concern. 

We have also seen enough progress in the contract management 
area at DOD to warrant narrowing that area, particularly as it re- 
lates to contracting tools and techniques. This is to ensure that 
they do not use overuse undefinitized contracts and time and mate- 
rials contracts, which are more risky to the government. They also 
plan to ensure more competition and they have better oversight 
over those processes now. But, the remaining areas they need to 
fix are: (1) service acquisitions, (2) ensure they have an acquisition 
workforce commensurate with the challenges associated with that, 
and (3) they have to make improvements in operational contracting 
where they are using contracting to support military operations in 
the theater. 

We have also noted improvements in the Department of Home- 
land Security management functions. That area has been on the 
list for a number of years. We are very pleased with the leadership 
commitment of that Department and the Secretary, Deputy Sec- 
retary, and Under Secretary for Management. They have a very 
good corrective action plan and they are starting to make progress. 
They have received clean opinions on their financial statements for 
2 years in a row right now, but there are other areas that they 
need to fix. They have fixed about 9 of the 30 areas that we have 
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identified and they have agreed it needs to be fixed. So, they have 
to fix the remaining 21 areas, but they have a good plan. They just 
have to execute the plan over a period of time, particularly in the 
acquisition area and some remaining areas in financial manage- 
ment, particularly on internal controls. 

Now, we are adding two new areas. First is VA’s provision of 
health care services to our veterans. We have been very concerned 
about this area and really have five overarching themes of concern. 
One is ambiguous policies and inconsistent processes over time. 
The fact that they have inadequate oversight and accountability 
mechanisms. They have information technology challenges that 
they have to solve. There is inadequate training of VA staff and un- 
clear resource needs and allocation processes. And, I can talk more 
about this in the Q and A session. 

Congress has passed legislation providing them with additional 
money, $15 billion, but the legislation has to be implemented effec- 
tively. And, as Senator Johnson has mentioned, we have over 100 
recommendations that we have made to the VA that have not yet 
been fully implemented and they need to do so. 

The other area, new, that we are adding is IT acquisitions and 
operations. The report that we are providing today outlines a litany 
of failed IT modernizations in the government, where hundreds of 
millions of dollars, and in some cases billions of dollars, have been 
spent, but the effort has been terminated or failed. There is even 
a longer list of areas that have cost overruns, schedule slippages, 
or provide less functionality than initially intended, thereby not 
really improving operations in the agencies that much. 

Confess passed some legislation late last year, the Federal In- 
formation Technology Reform Act, that gives Chief Information Of- 
ficers (CIOs) additional authorities and puts in place in statute a 
number of good practices that we have identified, but it has to be 
implemented effectively. Typically, we have found these areas lack 
discipline and requirements management and project management 
to actually manage IT acquisitions effectively. 

We also talk about operations. Fifty-eight of the $80 billion that 
is spent each year is on operations and support of legacy systems 
that we believe may not be needed, may be duplicative, and may 
no longer be performing as efficiently and effectively as possible, 
particularly given opportunities in the marketplace to get IT serv- 
ices at less cost. 

In this new High-Risk Area, over the last 5 years alone, we have 
made 737 recommendations and only 23 percent have been fully 
implemented. So, again. Congress has made efforts in VA and IT, 
but the efforts need to be monitored. Congressional oversight is im- 
perative, in my opinion. And, the agencies need to make reforms. 

We are expanding two areas. One is in tax administration. We 
had been focused on the next tax gap, which the annual latest esti- 
mate is $385 billion between taxes owed and taxes paid. But, iden- 
tity theft has become a growing problem, so we are adding that to 
the list. The Internal Revenue Service (IRS) was successful in stop- 
ping about $24 billion last year, but they missed, on their estimate, 
about $5.8 billion in fraud. We have some potential action to rem- 
edy this situation and recommendations for the Congress and the 
IRS we can talk about in the Q and A session. 
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The last area is cybersecurity. We initially designated computer 
security across the entire Federal Government at High-Risk in 
1997. In 2003, we added critical infrastructure protection, because 
most of the computer assets are in the private sector. But, now, we 
are adding privacy to the High-Risk issue as more personally iden- 
tifiable information (PII) is being collected. The number of inci- 
dents at the Federal Government level involving inadequate con- 
trols over IT, controls over the personally identifiable information, 
has more than doubled in the last 5 years. There have been a lot 
of high-profile incidents in the private sector, as well. Privacy law 
was passed in 1974. We believe it needs to be updated to provide 
greater controls, and we can talk about our recommendations. 

In closing, I would like to recognize that the progress that we did 
note in many of the areas was due to the Congress taking action, 
passing legislation. For example, five bills alone in the 
cybersecurity area, but more is needed, as we have talked about, 
in that area. Top leaders in the agencies and 0MB have been fo- 
cused on our High-Risk list. I have regular meetings with 0MB 
Deputy for Management Beth Cobert and top officials in the agen- 
cies to discuss the High-Risk Areas and what needs to be done spe- 
cifically to get off the list and to make continued progress. 

I appreciate the opportunity to be here today to discuss this fur- 
ther and look forward to working with this Committee. Fixing 
these high-risk problems as the potential to save billions of dollars, 
improve services to the public, and enhance trust and confidence in 
the Federal Government’s activities. 

So, thank you very much for the opportunity to be here. I would 
be happy to answer questions. 

Chairman JOHNSON. Well, thank you, Mr. Dodaro. 

Let me start with an apology. You are so familiar to me — ^you are 
the face of the GAO — I forgot to introduce you to those that may 
not be as familiar, so let me do it right now. 

Eugene Dodaro has been the Comptroller General of the U.S. 
Government Accountability Office since 2010 and has more than 40 
years’ experience at the agency, including as Acting Comptroller 
General, Chief Operating Officer, and Head of the Accounting and 
Information Management Division. So, you have extensive knowl- 
edge and we certainly appreciate your service. 

Let us talk dollars. We are both accountants. I was really pleas- 
antly surprised at the answer I got when I asked for how much 
have we saved just in the last couple of years and the figure was 
$40 billion. I will not investigate that. We will take you at your 
word. 

If we were to implement the recommendations on the current 
High-Risk List — I realize this is impossible to probably answer, but 
I would like you to take a stab at it — what would you think might 
be the potential savings? 

Mr. Dodaro. Well, I will just give you two benchmarks that 
would give you some idea of the magnitude of the potential savings. 
Improper payments this past year alone in the Medicare program 
were $60 billion. In Medicaid, it was over $17 billion. And, in the 
Earned Income Tax Credit, it was over $14 billion. So, any effort 
to reduce the size of those improper payments and ensure better 
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integrity in the payment process can yield billions, if not more, in 
savings, right in those three programs alone on the list. 

The DOD weapons acquisitions area has hundreds of billions of 
dollars in potential investments. Some of the $40 billion in savings 
have come from identifying weapons systems that were not ready 
to go into production, that would have wasted funds, and DOD or 
the Congress made decisions to reduce the procurement orders for 
those areas. 

And, let us take the tax gap alone. Any amount reducing one per- 
cent the tax gap — right now, there is 84 percent compliance, so we 
have about 16 percent noncompliance in the country, and it goes 
across the range of different taxpayers, whether it is business or 
individual taxpayers or small businesses. Any one percent increase 
in collection of taxes owed is $4 billion right there. 

So, there is lots of money on the table that is not being collected 
that should be collected. There is money being paid that should not 
be paid. So, there are plenty of opportunities to save money in 
these areas. 

And, I am particularly concerned that in the Medicare and Med- 
icaid area, because they are the fastest growing Federal programs, 
if the Centers for Medicare and Medicaid Services (CMS) does not 
get a better handle on these areas, that problem will get a lot 
worse before it will get better. 

Chairman JOHNSON. Well, my back-of-the-envelope calculation, 
you are already talking about close to $100 billion just right then 
and there. 

I know Senator Carper talked about Senator Coburn earlier 
using GAO reports. Senator Coburn always used to publish the 
“Waste Book,” unfortunately, after the money was spent. My goal 
would be, let us publish a “Waste Book” before the money is spent, 
and again, you gave us the guideposts for doing that. 

Talk about implementation. I mean, what can we do? What could 
this Committee potentially do to induce, might I say, force imple- 
mentation, because you have so much money at stake. And, like I 
say, it is not just money. Take a look at the VA. It could be lives. 
I mean, what can we do to prompt, induce, force as full implemen- 
tation of your recommendations as possible? 

Mr. Dodaro. I will give you an example of one of the things that 
I have done that I think could be replicated in the Congress to real- 
ly induce more progress. One is, since I became Comptroller Gen- 
eral, I went to 0MB and I said, look, you have real serious prob- 
lems here across the spectrum of the Federal Government. During 
the Bush Administration, GAO started having meetings with 0MB 
and the agencies on the High-Risk List, but it was usually at the 
Assistant Secretary level and below. 

And I said, look, if you get the head or the deputy of the agency 
here to the meeting and the Deputy Director for Management is at 
the meeting, I personally will participate in those meetings to focus 
on what needs to be done to make improvement. We have been 
doing that for the past couple of years. I attribute raising the ele- 
vation of that level to the top agency leaders in the agency to the 
degree of progress that we have seen over the past several years. 

I believe engagement with those top officials, whether it be in a 
hearing or it be in a private meeting, it be with correspondence or 
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other efforts, with the Congress and with the agency, is really im- 
portant. 

The second major thing Congress could do, on the High-Risk List, 
you will see an asterisk beside every area that requires Congress 
to act and pass legislation in order to rectify the High-Risk Area. 
Financing the Nation’s surface transportation system is an exam- 
ple. Postal Service reform is another example in that area. And, 
there are many other areas on the High-Risk List where Congress 
is an integral part of actually fixing the problem, and we have 
noted that so that the Congress could focus on those areas. 

So, those are two real fundamental things that I think are very 
important, and ensuring continuity over time so that progress can 
be achieved. 

One of the reasons I was very convinced to put VA Health Care 
and IT acquisitions and reform on those areas is because, I believe 
neither one will be fully resolved during this Administration’s 
watch and will have to be continued and sustained into the next 
Administration. And, so, it is very important to have that con- 
tinuity to focus on these problems. 

Chairman Johnson. Well, certainly, one of the things we can do 
with this Committee is hold those hearings. We will work very 
closely with you to schedule those hearings and have you have a 
seat at the table as we are talking to those agencies. 

Mr. Dodaro. We would be happy to. 

Chairman Johnson. I do want to, in my remaining time, I want 
to drill down in terms of the VA Health Care System. A hundred 
recommendations. Over what time period have you been issuing 
those recommendations? Why have they not been implemented? 
And, can you just kind of speak to the major recommendations that 
you think really need to be prioritized for implementation. 

Mr. Dodaro. Sure. I will ask my colleague, Debbie Draper, who 
is focused on that work, to come to the table to help me answer 
the questions, but I will start. 

We first started reporting on this problem in the year 2000, so 
the recommendations have been made over a number of years. 
And, I might point out, in a number of these cases, VA agreed to 
implement the recommendations, but they were not being imple- 
mented over time effectively. I met with Secretary Eric Shinseki 
when he was there, talked about the need to implement the rec- 
ommendations. I have just met with Secretary Robert A. McDonald 
and he agreed to make it a priority to implement the recommenda- 
tions. 

Most of them are on access to care issues, where they do not 
have good scheduling systems put in place. The IT system that 
supports the scheduling system is about 30 years old. One of the 
IT failures that we point out in our report explained that after 7 
or 9 years and over $200 million, they terminated their effort to 
upgrade and modernize that system. 

They do not have good data in a lot of areas to compare whether 
it is cheaper for certain particular services to give treatment in a 
VA facility or send the person to a non-VA facility, and this is real- 
ly important because Congress has just given them $10 billion to 
make those decisions. They do not have good information to make 
well-informed decisions in those areas. 
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But, Debbie has been doing a terrific job. I will ask her to elabo- 
rate a little bit more. 

Chairman JOHNSON. Please. 

Ms. Draper. Thank you. So, we made 167 recommendations over 
the past 5 years, and there are actually more prior to the 5-years, 
but more recently, it is 167. Just over 20 percent of those have 
been completely implemented and closed. So, there is a large num- 
ber of recommendations, as Gene talked about. There are a lot re- 
lated to access to care. And, it is not just the policies. It gets back 
to the five broad buckets of why we included VA Health Care in 
the High-Risk List. 

Inconsistent processes that play out at the local level — ^you have 
a lot of variation at the local level, and this is really attributed to 
ambiguous policies, which are widely interpreted. Policies do not 
tend to be standardized processes across the VA Medical Centers 
(VAMC). We also see certainly inadequate oversight and account- 
ability and, for example, VA tends to rely on self-reported compli- 
ance with policies, and that information is often not verified. So, 
when we go in, we look at those compliance issues and, contrary 
to what the facilities have reported, most of the times, they are not 
in full compliance with the policy. So, there are a lot of different 
areas, but there are a large number of recommendations that re- 
main open. 

Chairman JOHNSON. Well, thank you. We will work very closely 
with you in terms of trying to push and prod the VA to implement 
those recommendations as rapidly as possible, so we look forward 
to working with you. Senator Carper. 

Senator Carper. Thank you, Mr. Chairman. 

You mentioned how large the tax gap is, and I think the number 
you mentioned. Gene, was $385 billion, is that correct? 

Mr. Dodaro. Yes. That is the net amount. There is a gross 
amount, and then IRS expects to collect so much. Yes. 

Senator Carper. Is that money that is owed in one-time money, 
or is it money that is lost on a recurring basis? 

Mr. Dodaro. It is the latest estimate based upon tax year 2006. 
One of the reasons that the IRS has been on the list for many 
years, and the original list in 1990, was tax administration, where 
they were not measuring the tax gap. And, so, after a number of 
years and prodding by us and the Congress, they finally started 
measuring it. It is expensive to measure it, so that is the latest es- 
timate. But, it is an annual estimate. 

Senator Carper. All right. The Commissioner of the IRS is a fel- 
low named John Koskinen, whom you probably know. Have you 
met with him? 

Mr. Dodaro. I have worked with John in many areas over the 
years. He used to be the Deputy for Management at 0MB. Actu- 
ally, John and I worked to put in the Chief Financial Officer struc- 
ture into the government and on legislative initiatives to actually 
create CIOs across the government and fixing the Y2K problem. So, 
I have much knowledge of working with John and I have met with 
him in his new capacity. 

Senator Carper. That is good. He is a very impressive leader, 
and I am hopeful he is going to provide wonderful leadership at the 
IRS. 
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He testified before the Finance Committee last week, and later 
I met with him in my office. One of the things that he mentioned 
to me is that for every dollar that we invest in the IRS and their 
people and their technology, they generate roughly $10 worth of 
revenue. And, if you look at the amount of money that we provide 
for the IRS to do their job now, we actually provide less than we 
did a few years ago. And, as you suggest, we are leaving about 
$400 billion of money on the table of money that is not being col- 
lected. Would you just care to comment on his observation? 

Mr. Dodaro. Yes. We have reported — in fact, we rate IRS as “not 
met” in the capacity area to fix this problem, largely because of 
some of the resources and the uncertain budget environment in 
this area going forward. Now, that being said, though, we also have 
a number of recommendations that they need to look at and evalu- 
ate the return on investment that they are getting from different 
enforcement efforts, and they could do more with the resources that 
they have been given and prioritize those efforts. So, we have a 
number of recommendations in those areas. 

But, that is an area that I believe needs attention to make sure 
that they have the resources necessary to be able to improve collec- 
tions. They have been having budget cuts and they have been given 
increased responsibilities in the Affordable Care Act and a number 
of other 

Senator Carper. And, the other thing they have been given is a 
tax code that is not made more simple every year, but generally 
made more complex. And, we muck around with it and change it 
at the last hour or do not change it and we make it difficult for 
them to actually provide the information to people who want to file 
their taxes in a timely way. There is plenty of work to be done 
here, but a good deal of that work is to be done by my colleagues, 
not just on this Committee, but our colleagues in the House and 
Senate working with the Administration, and thank you. 

Mr. Dodaro. And there are some things that Congress could do 
to help IRS. One thing to do would be to increase the requirement 
for electronic filing. Another would be to give them additional math 
authority where they could fix errors right on the spot rather than 
generating and spending a lot of time over those errors. So, we 
have a lot of recommendations. Obviously, simplifying the tax code 
would be tremendously helpful. 

Senator Carper. They have also been asking for legislation that 
would enable them to better ensure some quality in terms of capa- 
bility of the people who help prepare returns and file returns. 

Mr. Dodaro. Yes. 

Senator Carper. I think that is a very large problem. 

Mr. Dodaro. Yes. We have made that recommendation. We stud- 
ied the use of that in Oregon. Oregon was actually piloting it for 
their own State and they found that making certification, training 
requirements for paid tax preparers increased their collections and 
we recommended that IRS do it. They went forward and the courts 
have ruled they did not have the authority to do it, and so it is 
really in Congress’ hands right now to give them that authority. 
We continue to recommend that would be a good thing to do. 

About 60 percent, of the people go to paid tax preparers. We have 
done work in the past where we have sent undercover teams in to 



12 


paid tax preparers, and the last time we did it, three out of ten 
were making mistakes and particularly errors in the Earned In- 
come Tax Credit area. 

Senator Carper. Good. Thank you for that. 

You mentioned the number of items that have been listed on the 
High-Risk List for years, and I think there are hundreds that still 
remain to be fully addressed and resolved. But, we have made 
progress. The agencies throughout the government have made 
progress. You mentioned a number of those areas where that 
progress has been made. Some of it is in the Department of Home- 
land Security, which we have jurisdiction over. We are pleased 
with that. Some is within the Department of Defense, and they 
have a lot more to do, but there is some good work that is being 
done. 

But, if you think about the areas, where it is department-wide 
or with respect to specific parts of the departments’ jurisdiction 
where actually real progress is being made, the real attention is 
being paid to the recommendations that they are receiving from 
you and, frankly, the hearings that we hold and the oversight that 
we conduct. What are the factors that better ensure progress? I like 
to say, find out what works, do more of that. 

Mr. Dodaro. Right. 

Senator Carper. What are the factors that appear again and 
again to be successful here? 

Mr. Dodaro. Yes. No. 1 is top leadership commitment. If you do 
not have the head of the agency or the deputy focused on this 
issue, you will make marginal progress, at best, in those areas. 
And, what I have seen, in Homeland Security, I have talked to Sec- 
retary Janet Napolitano, Secretary Jeh Johnson, the deputies, Jane 
Holl Lute, and Alejandro Mayorkas are focused on this, as well as 
the Under Secretaries for Management, just to give one example. 
The same thing at National Aeronautics and Space Administration 
(NASA). The deputy has been focused on this. Bob Lightfoot, and 
I know John Koskinen at IRS. So, the top people need to be fo- 
cused. These are big, tough problems. They require prioritization in 
the agencies. They require changes in the culture of the agencies, 
and if they are not led from the top, they are not going to be suc- 
cessful. 

Second thing is a good plan. A number of agencies start initia- 
tives. There are no real performance measures or metrics in the 
initiatives. There is no way to hold people accountable for interim 
progress. The next thing you know, they are gone and there is a 
new political person that we are dealing with in the agency and we 
kind of start all over again. If there is a plan in place that has been 
followed, that is a good plan that has milestones and metrics that 
can transcend changes in political leadership in the Departments. 

And, so, those two things are really very imperative, and the 
third thing would be engagement from the Congress. If it does not 
matter to the Congress and does not matter to the agencies appro- 
priation and does not matter to its oversight, it is not going to mat- 
ter to the agency. And, I can say all that I can say and encourage 
them, but Congress has to be a real partner in this effort to ensure 
success. 
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Senator Carper. Thank you for all that. Let me just conclude, 
Mr. Chairman, on one last point. 

I say to my colleagues, particularly those that are new, improper 
payments are a huge problem, and while they are being actually 
addressed, satisfactorily addressed in a number of areas, a big one 
that is still the elephant in the room is health care. Medicare espe- 
cially, where the improper payments have gone up by about $15 
billion, and Medicaid, which has ticked up by about another few 
billion dollars. 

Dr. Coburn and I introduced in the last Congress something 
called the PRIME Act. It had over 25 cosponsors, and some of you 
on this Committee were cosponsors. We put it in the sustainable 
growth rate (SGR) fix, could not get it passed, but we are going to 
reintroduce it. My hope is that many Members of this Committee 
will be cosponsors of that legislation. We need to get it done. It will 
help ratchet down some of those improper payments, especially in 
Medicare and Medicaid, and we need to make progress. 

Mr. Dodaro. Senator, if I might add, one additional area that I 
think Congress needs to focus on is the Temporary Assistance for 
Needy Families program. Right now, the Department of Health and 
Human Services (HHS) does not believe it has the authority to col- 
lect information from the States to measure improper payments, so 
it is one large program where there is no measurement going on 
at all, and I think Congress needs to send a signal 

Senator Carper. Good. 

Mr. Dodaro [continuing]. That needs to be taken care of. 

Senator Carper. Thank you. We will add that to our “to-do” list. 
Thank you. Thanks so much. 

Chairman Johnson. Thanks, Senator Carper. I think you can 
rest assured that this Committee will be engaged, and the two of 
us working together, we will. 

Before I call on Senator Lankford, you mentioned a 10-to-l pay- 
back for the IRS. I did not mention in the Committee but I men- 
tioned in the press conference, we often talk about cutting budgets 
and all we are really talking about is reducing the rate of growth 
in spending. Unfortunately, the GAO is one of these agencies where 
we have actually cut spending. We have gone from $556 million in 
2010 to $480 million in 2013 and $522 million in 2014. 

A quick back-of-the-envelope calculation in terms of payback, 
using your $40 billion figures, that is a 76-to-l payback. Now, some 
of those may be one-time savings. But, if you add the $100 billion 
of Medicare and Medicaid and the other things you mentioned, that 
is a 268-to-l payback. So, I would recommend that certainly all the 
Committee members be somewhat supportive of making sure that 
the GAO is fully funded because it is a pretty effective payback. 
Senator Lankford. 

OPENING STATEMENT OF SENATOR LANKFORD 

Senator Lankford. Comptroller Dodaro, thanks for being here, 
and thanks for all the work you and your whole team do to help 
keep us informed on some of these issues. 

I want to mention one thing that has been on your list for quite 
a while and that is managing Federal real property. I was sur- 
prised, because I know there has been a big initiative to try to 
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lower the footprint of the Federal Government and the real prop- 
erty that are both owned and leased, the Freeze the Footprint Ini- 
tiative that started several years ago to try to at least drop our 
hold to what we have. 

I was a little surprised to see in your report that it listed that 
you all had done some studies on some of the Freeze the Footprint 
data and the drop, the 10 million square feet that we have actually 
reduced, when you actually studied and looked at it, you said it ac- 
tually did not happen. They had either just moved to the General 
Services Administration (GSA) or it was just a timing issue. I 
wanted to give you a chance to talk about that a little bit, because 
this is a big issue that we have to resolve at some point. We have 
a lot of Federal real property out there. 

Mr. Dodaro. Yes. I am going to ask our expert in the area, Phil 
Herr, to come up and talk about it, but you are exactly right. I 
mean, what we found was that many of the initiatives that were 
underway before they started Freeze the Footprint activities, so 
they really were not attributable to the initiative. 

A big problem in this area is lack of reliable data. 

Senator Lankford. Right. 

Mr. Dodaro. That is one of the biggest problems. The govern- 
ment has a lot of underutilized or not utilized at all properties that 
need to be taken care of. There is an over-reliance on leasing in the 
Federal Government, where it may be more cost advantageous to 
have ownership over those areas over time. We have pointed out 
the program is not doing a very good job in securing the property, 
as well. 

But, Phil can talk a little bit more about that particular study 
that you have talked about, but your characterization is accurate, 
for sure. 

Mr. Herr. Yes. I would just add that it is a great example of the 
need for continuity and to followup. We know that 0MB is working 
with GSA on a governmentwide strategy that is due in 2015. That 
is one we will be looking at closely. But, it is also really important, 
and I think it emphasizes the point that the Comptroller General 
just made, about just looking at the data and ensuring that there 
is integrity and looking and making sure those calculations are cor- 
rect. When we did that, we found that there were some questions 
about double-counting, things being counted in multiple years, so — 
and that is a good example for the kind of oversight your Com- 
mittee can do. 

Senator Lankford. When we deal with actual disposal of prop- 
erty, obviously, we have all gone through for years the difficulty of 
actually disposing of real property that we own. 

Mr. Herr. Correct. 

Senator Lankeord. So, have you all done any examinations for 
those independent disposal authority, those agencies that have 
that, their capacity to be able to dispose of property versus other 
agencies in the Federal Government, or when you deal with, for in- 
stance, the Department of Interior (DOT) and some of their authori- 
ties to be able to move out properties versus others? 

Mr. Herr. We have not looked through that particular lens. The 
one thing we have looked at consistently are some of the barriers 
that agencies encounter in doing this. There is the processes — we 
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just did a report on the McKinney-Vento process and how that 
might he streamlined and how there could he better accountability, 
because that is something the property has to go through — agencies 
have to go through before proceeding with the disposal. 

Senator Lankford. So, the Department of Interior that has the 
expedited conveyance process, where they can look at State and 
local governments, if this is going to be transitioned into other pub- 
lic uses, seems to be a faster process. Have you all had any oppor- 
tunity to be able to examine that process and see if it is being effec- 
tive — 

Mr. Herr. Not in real depth, but that would be something we 
would be happy to work with the Committee on. 

Senator Lankford. OK. that is one of the issues that I hope we 
can take a look at some point, to find out what is working, because 
it does not seem like every agency has this issue, but a lot of agen- 
cies do 

Mr. Herr. They do. 

Senator Lankford [continuing]. To find out which agency is 
being effective at actually transitioning property that really works 
and what process is helping us in this. 

I want to go back to some of our conversation on tax issues, as 
well, if I can jump back to that. The identity theft, you all brought 
up a very interesting set of statements there and I would like to 
go into a little greater depth on it, about the W-2 form and the 
time period of the W-2 form and how we have identity theft basi- 
cally because the W-2 form does not come in late and we are doing 
returns early and there is a great opportunity for identity theft. 
How does that get resolved? 

Mr. Dodaro. Under the current approach, IRS starts processing 
returns early. They do not receive the W-2s from the employers 
until April. They go to SSA first. There is a different deadline in 
statute. So, we are recommending that the Congress should give 
IRS authority to require employees to file W-2s earlier. But, IRS 
really has not studied the costs and benefits of that. It may impose 
some burdens on the employers, and so we are recommending IRS 
study that. So, that is No. 1. 

Senator Lankford. So, is it possible to just have that the returns 
cannot go out until the W-2s are in? 

Mr. Dodaro. Well, that is another possibility, but it will delay 
refunds, and, the 

Senator Lankford. People get pretty excited about that. 

Mr. Dodaro. Yes. Right. [Laughter.] 

Particularly those that are expecting a big refund 

Senator Lankford. Sure, but we have also $5 billion of fraud 
that is sitting out there from identity theft 

Mr. Dodaro. Right. 

Senator Lankford [continuing]. And people are filing their taxes 
and finding out someone has already filed under that same num- 
ber. 

Mr. Dodaro. Yes, and that is why we are asking IRS to study 
this thing, so Congress can make an informed decision. You might 
want to delay it a little bit and accelerate the reporting. I mean, 
there is a lot of room between the end of January, when employees 
receive their statements, and April. But, right now, the only way 
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they find out that there is fraud is when the honest taxpayer actu- 
ally files their return and IRS says, whoops, we already paid the 
refund to somebody else who used your identity. And, the way peo- 
ple can get the information to file fraudulently now, either at the 
Federal or at the State level, is so easy to be able to do it. 

The other thing that could be done is to give IRS math authority. 
In some cases, they know that a return is incorrect. They could fix 
it right away and not cause a problem over a period of time. 

And, the third thing would be what we were talking about a lit- 
tle bit earlier, in having certification requirements and training re- 
quirements for paid preparers in a lot of cases. We know in some 
cases paid preparers are not giving the best advice to people. In the 
vast majority of cases, they do. 

So, those three things, we think, can really help address this 
problem. 

Senator Lankford. One quick transition, as well, and that is to 
the surface transportation. I know that you looked at some of the 
needs, obviously, that are sitting out there that are financial needs 
and that Congress needs to address. Have you had the opportunity 
to be able to look at the expansion of what is considered a Federal 
project over the last 20 years, just on the number of miles or roads 
or type of roads, because there has not only been an expansion of 
the need, but there has also been a tremendous expansion — my 
perception is — of the number of miles that are considered Federal 
project or the number of things that are considered Federal project 
in the last 20 years. 

Mr. Dodaro. Phil also happens to be our transportation expert 
so he is 

Mr. Herr. I will double-dip here. We have done some work re- 
lated to that. I mean, one of the things that gets put into the High- 
way Trust Fund, you get a lot of the safety programs and things 
of that nature. Transit is also funded out of the Highway Trust 
Fund. So, you have a lot of things that have been put in there, a 
lot more demands, and the system is aging, so additional resources 
need to go into that to just help maintain those systems. And, the 
Interstate is now 50 years old, so rebuilding that is a big part of 
it. 

Mr. Dodaro. Yes, and our focus has been on the financing 
streams that go in there. Obviously, the Highway Trust Fund has 
not been able to meet the needs, and it is declining for a wide num- 
ber of reasons. 

Senator Lankford. Right. 

And part of my question was just related to the actual roads 
themselves. I understand the safety and the transit and other 
things, but the actual number of roads that are considered Federal 
projects versus 20 years ago, the number of roads that were consid- 
ered Federal projects. 

Mr. Herr. Well, they worked to bring in the National Highway 
System, so that would be one area where you Federalized some of 
those. But, we can get back to you with additional data on that. 

Senator Lankford. Thank you. I yield back. 

Chairman JOHNSON. A real quick question. Is not the W-2 a 
multiple-part form? Would not a pretty simple solution be to add 
another copy? 
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Mr. Dodaro. I will talk to our experts about it and see what 

Chairman JOHNSON. Senator McCaskill. 

OPENING STATEMEN TO SENATOR MCCASKILL 

Senator McCaskill. Yes. I was going to say the same thing. If 
the employee gets it in January, or early, that means the employer 
has it, so it is not like we are asking the employer to produce some- 
thing earlier, because it has already been produced. We are just 
asking employers to get it in the hands of the IRS earlier. So, I do 
not know that asking the IRS to study this is a good idea — because 
I know what that “study” word means. It means we are going to 
be at this for much longer than we should be at it. So, Mr. Chair- 
man, I would like to 

Chairman JOHNSON. We will cosponsor a bill. 

Senator McCaskill [continuing]. See if we cannot, with the pro- 
tection of the Chairman, who would stand for the proposition that 
we are not trying to burden businesses, maybe we can get through 
this. 

Chairman JOHNSON. They should not be a burden. 

Senator McCaskill. There we go. 

Our Subcommittee last year held hearings, as you know. First of 
all, good to see all of you. Your stuff is required reading in my 
shop. Someone asked me about how depressing it must be to be in 
the minority, and I said, one thing about oversight, a GAO report 
is the same when you are a Democrat in the majority and the same 
when you are a Democrat in the minority. Thank you for all of your 
work and please share that with all of your colleagues at the moth- 
er ship. [Laughter.] 

We held a hearing last year, in the last Congress, about the over- 
payments in medical equipment, as you know. I want to make sure 
everybody understands how bad this is. In 2012, according to the 
data provided by the Centers for Medicare and Medicaid Services, 
they made improper payments on medical equipment of almost $6 
billion. So, that means there is $6 billion worth of pure waste, over- 
payments being made, on durable medical equipment. And, that is 
an error rate — just so people have a concept of how bad it is — of 
66 percent. They recover hardly any of these payments. I think in 
the last data we had available, CMS recovered only $34 million of 
an estimated $5.2 billion in improper payments. 

We learned in that hearing that they do not do anything up front 
to screen. They keep sending to one address, thousands of busi- 
nesses registered at one address, until after the fact, then clawing 
back and they are gone. They are indicted. In fact, one of the com- 
panies was at that hearing. As you recall, I was very suspicious 
about their name. Their name was Med-slash-Care. They were call- 
ing seniors and saying, “This is Medicare.” And you can get this 
and you need this. They were sent all this stuff out and they were 
criminally raided by the FBI a few weeks ago. 

So, your recommendations to CMS have not been followed. What 
is your sense as to what is the problem at CMS that they will not 
accept and adopt the recommendations in this incredibly low-hang- 
ing fruit where we could save a lot of money? 

Mr. Dodaro. Yes. Cindy Bascetta is our expert in that health 
care area. I will give my take and I ask her to provide more detail. 
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First of all, part of this is changing this culture that had heen 
ingrained in CMS for years. It was to pay fast and get the money 
in the hands of the providers to make sure there was nobody who 
needed care that was not receiving care, and so that culture is real- 
ly ingrained in the process over a period of time. 

And, they have established a Payment Integrity Center, but they 
are slow to implement these recommendations. You have to keep 
bad actors out of the system. One of the things was to establish a 
surety bond up front so that there is money that the contractors 
have put up. They finally now have gotten to where they have a 
contractor that can do fingerprint and background checks ahead of 
time, so they are going to put that in place. 

So, the first thing is to stop bad actors from getting into the sys- 
tem to be providers, and that has been difficult for them to grapple 
with, and they are starting to move slowly in that area. 

The other thing is they give an incredible amount of discretion 
to the contractors who are making these payments in error. You 
would think Medicare was one system, but it really is not. There 
is a lot of discretion given to the contractors. We have been trying 
to say, get the contractors to identify their best practices for pre- 
venting payments and recovering the funds and to share that with 
all the contractors so that there can be best practices. That has not 
been implemented. We have encouraged them to set up core com- 
pliance programs that providers have to follow. That has not been 
implemented yet. 

I have tried to raise this as an issue. I have met with Secretary 
Sylvia Mathews Burwell and the former head of CMS, Ms. 
Tavenner, and I emphasized these open recommendations we had 
and the need to implement the changes. So, I have certainly been 
doing everything I can. I think additional congressional oversight 
would be really helpful in this area, and I will let Cindy give any- 
more details. 

Ms. Bascetta. I would just add that we have also encouraged 
them very strongly to move more quickly on their predictive ana- 
lytics, which would really help prevent the overpayments in the 
first place and identify bad actors rather than recoup payments. 
With respect to durable medical equipment (DME), I just point out 
that their competitive bidding program that was instituted several 
years ago 

Senator McCaskill. It is working. 

Ms. Bascetta [continuing]. Has, indeed 

Mr. Dodaro. Yes. 

Ms. Bascetta [continuing]. Yielded many savings. We are watch- 
ing carefully to make sure that they do not get to the point where 
there might be negative effects on beneficiary access to the equip- 
ment that they need. But, they are making progress in that area. 

Mr. Dodaro. But, you are right. The problem is bad. 

Senator McCaskill. It is bad. 

Mr. Dodaro. And it is going to get worse, because of the fast 

Senator McCaskill. It is going to get worse, and there are 
things that can be done to fix it. 

Mr. Dodaro. Right. 

Senator McCaskill. So, I know Chairman Susan Collins — she 
and I are serving on the Aging Committee now — I know we are 
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going to continue this investigation, and continue to put pressure 
on CMS. 

In the comprehensive immigration reform bill that was passed by 
a wide bipartisan margin in the Senate, we funded an additional 
$46 billion in border security. I am confident, no matter how the 
immigration politics play out over the coming months in this Con- 
gress, that all of us agree that there has to be additional significant 
funding on the border. I am worried about whether or not DHS 
management is ready to absorb this flood of funding. I am trying 
to remember — 53 miles of the border, I think, we did for a billion 
dollars. That is not exactly encouraging, that it took us a billion 
dollars to do 53 miles. 

I would like, just briefly, if somebody could speak to that, and, 
frankly, if you have an opinion, I think the Chairman is a former 
businessman and I know if he did not know if his receivables, if 
and when they were ever going to arrive, it would be very hard to 
manage an ongoing enterprise? And whether or not the fact that 
we are budgeting by crisis in fits and starts and continuing resolu- 
tions (CRs) and threatening shutdown, if that is contributing to 
some of the mismanagement at DHS. 

Mr. Dodaro. Well, I can just speak from trying to run the GAO 
under continuing resolutions; it is a difficult process. I told our ap- 
propriators one of the things I never aspired to be in public service 
was an expert at managing under continuing resolutions. It does 
create a lot of uncertainty and make it difficult to manage. 

Dave Maurer is here. He is in charge of our work at DHS. I do 
think they are still struggling in the acquisition area to properly 
manage their acquisitions. That is something we are keeping an 
eye on and we will focus on this additional funding. Dave. 

Mr. Maurer. That is absolutely right. Acquisition is one of the 
major challenges DHS faces on the management front. They also 
face some significant challenges in other aspects, as well. Employee 
morale, for example, at DHS has consistently been bottom-of-the- 
barrel compared to other departments. Their numbers have been 
going down at a faster rate than in other Federal agencies. That 
is something of concern. We are encouraged by the fact that the 
Secretary and the Deputy Secretary have taken some efforts to ad- 
dress both of those issues head on — both acquisitions and morale. 
It is something we are going to be watching very carefully in the 
coming years and months. 

Senator McCaskill. Thank you, Mr. Chairman. 

Chairman JOHNSON. Real quick, to answer your question of the 
Chair, it is our side of the aisle that is actually trying to get a bill 
on the floor to be debated to fund the Department, so 

Senator McCaskill. Well, we would disagree on that. 

Chairman JOHNSON. I think, also. Senator Baldwin and I will 
also agree that I think our paper industry would kind of like our 
W-2 fix, so we will work on that. 

Senator McCaskill. That is right. 

Chairman JOHNSON. Senator Baldwin. 
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OPENING STATEMENT OF SENATOR BALDWIN 

Senator Baldwin. Thank you, Mr. Chairman, and Mr. Dodaro, 
thank you for being with us today. 

I would like to focus in on the problems that you have identified 
in the GAO report with the Veterans Health Administration 
(VHA), both systemwide but also in Wisconsin and facility-based 
issues. The GAO report provides ample evidence to corroborate 
what I have learned in disturbing detail over recent weeks, that 
the VHA suffers from mismanagement and inadequate oversight, 
especially of individual facilities. It appears that the Veterans 
Health Administration lacks not only clear and appropriate system- 
wide policies and protocols, but also lacks the ability to ensure that 
they are followed at the facility and the regional Veterans Inte- 
grated Service Networks (VISN) level. 

For example, at the Tomah VA facility in Wisconsin, current and 
former employees and veteran patients have brought to my atten- 
tion allegations of inappropriate opioid prescription practices and 
abuse of administrative authority, including retaliation against 
whistleblowers. This facility is currently under investigation by 
Secretary McDonald and we all hope that it yields appropriate and 
positive results. But, make no mistake, extremely troubling issues 
have come to light regarding the VA and this specific facility, and 
I believe that Congress is going to have to act in a variety of ways 
to make improvements so that our veterans in Wisconsin receive 
the care that they deserve. 

Mr. Dodaro, in the case of the Tomah VA facility, a report initi- 
ated in 2011 and concluded in March 2014 from the VA Office of 
Inspector General found evidence of troubling opioid prescription 
practices that were at considerable variance from peer facilities in 
the regional network. This report recommended changes to address 
those problems at the facility level, and subsequently, actions were 
taken. 

In the last month, however, media reports have revealed that 
whatever those actions were that took place to remedy the prob- 
lems had either not been implemented, not been implemented effec- 
tively, or were entirely insufficient. It is also unclear if any senior 
VA official ever was made aware of the report that the Inspector 
General did or the remedial actions that were recommended or 
taken at the Tomah VA. 

In your view, does the Veterans Health Administration have ade- 
quate oversight controls in place to ensure that facility-level prob- 
lems are first, identified, and then sufficiently addressed? 

Mr. Dodaro. I will ask Debbie Draper to elaborate on this. She 
is our expert in the VA area. 

But, one of the areas we point out in the report we are releasing 
today is there really is inadequate oversight and accountability. 
The individual facilities have been given wide latitude to imple- 
ment the policies and procedures. There are not reviews being done 
by headquarters that should be done of the facilities to make sure 
that they are adequately following the policies and procedures. 
And, when we go in, we find that those reviews are not done. They 
are relying on self-reported data from the facilities, which is not 
consistent with proper internal controls, and to have a good ac- 
countability and evaluation of function and program. So, it is a real 
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problem over there that needs attention, but I will ask Debbie to 
elaborate. 

Ms. Draper. I mean, it is certainly a system that is in need of 
major transformation, and I think that we have seen — and one of 
the reasons we have added it to the High-Risk List is that over and 
over in the past 5 years, the reports that we have issued have con- 
stantly highlighted the inadequate oversight and accountability 
and ambiguous policies and inconsistent processes. So, there is an 
aversion to standardization within the VA, but when you have that 
much autonomy at the local level, you often hear the story, you 
have seen one VA medical center, you have seen one VA medical 
center, and that is really true, because there are, like, 150 different 
processes that play out at the local level. 

We are particularly concerned because of the growing demands 
on the VA Health Care System. So, between 2002 and 2013, the 
number of veterans enrolled in VA health care increased from 6.8 
million to 8.9 million, and over that same period of time, the num- 
ber of outpatient medical appointments increased by 40 million. So, 
if you have weaknesses in place and you do not correct them, then 
the problems are going to really become much bigger. 

Senator Baldwin. Mr. Chairman, I have a second question on 
Tomah, but I believe I am not going to have time to get to a third 
question on a GAO report that was issued in November 2014 re- 
garding protocols with treatment of veterans with major depressive 
disorder. I would like to be able to submit that remaining question 
for the record and get a response after the fact. 

But, to my next question in the case of Tomah, there seemed to 
be virtually no internal Veterans Administration communication 
and certainly no external communication to Congress or the public 
regarding the problems at this facility. In fact, when I first con- 
tacted the Tomah facility and the VA headquarters here in Wash- 
ington on behalf of a constituent who had raised a number of con- 
cerns covered in the Office of Inspector General (GIG) report that 
I just referred to, no one at any level of the VA talked about the 
existence of this report or informed me of the existence of this re- 
port. 

And, in light of this lack of transparency, I wonder if you think 
that a GAO-type model of investigating, issuing recommendations, 
and requiring the affected agency or group to formally and publicly 
respond would improve the Veterans Health Administration’s abil- 
ity to perform successful oversight at the regional and individual 
facility level and hold them accountable for any wrongdoing uncov- 
ered. 

Mr. Dodaro. Well, there definitely needs to be accountability 
over reacting to audit findings. In fact, there is existing 0MB guid- 
ance that agencies are supposed to track audit reports and track 
followup efforts and have a response. I met with Secretary McDon- 
ald last Friday, actually, and he said he has given high priority to 
begin following up on IG recommendations and GAO recommenda- 
tions. So, hopefully, this will be addressed. 

But, you are exactly right. There are policies and procedures al- 
ready in place that should have assured that they followed up on 
every IG report and recommendation that would be in place, and 
GAO reports, as well. Those could be strengthened, and there may 
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be a need to do that in this particular case. But, those policies 
exist. So, it is a lack of compliance with existing policies that it 
sounds like. I mean, we have not looked at this specific informa- 
tion, so I really do not know for sure, but it sounds like from your 
description that they just did not adhere to the policies that al- 
ready exist. 

Senator Baldwin. Thank you, and I will submit for the record 
the GAO report^ that was issued in November 2014 regarding vet- 
erans who are diagnosed with major depressive disorder. It appears 
that there is a huge deviation from VA guidelines with regard to 
the treatment that you have uncovered and I think that is very dis- 
turbing and that we need to do more in followup to that, too. 

Mr. Dodaro. And we will be happy to respond. 

Chairman JOHNSON. Thank you. Senator Baldwin. I can assure 
everyone, this Committee will be fully engaged to make sure these 
recommendations are carried out, and we are going to do every- 
thing we can to make sure they are carried out. Senator Heitkamp. 

OPENING STATEMENT OF SENATOR H EITKAMP 

Senator Heitkamp. Thank you, Mr. Chairman. 

I want to get to process, because if we were going to go through 
each one of these and debate their relative merits. Comptroller, we 
would be here all day. And, so, I want to talk about why we have 
these hearings and then everybody retreats, goes back to their 
agency, goes back to what we do, and then we come a year later 
and have another discussion. 

So, I want to ask about ongoing supervision and get to the heart 
of what you were talking about earlier, which is agency heads 
change, administrators change, and then you are back in the game 
again trying to educate or re-educate on why these recommenda- 
tions were necessary. Let us just presuppose that every time some- 
thing like this was done, we had a sit-down, we had a strategic 
plan put together, time-lined, with accountability measures that 
everybody agreed to and said, “Yes, we are going to do it,” taking 
a look at — I think earlier. Senator McCaskill talked about return 
on investment, low-hanging fruit, prioritizing those things that ac- 
tually give us the biggest bang for the buck, and then periodically 
actually getting reports on whether we are meeting those require- 
ments so that this process becomes institutionalized between the 
Congress and the agencies and GAO. 

Mr. Dodaro. I think that would be an excellent idea and I would 
be happy to participate. 

Senator Heitkamp. I think it would be an excellent idea, but I 

have a tendency to fall in love with my ideas, so I just need 

[Laughter.] 

I need people to argue against me frequently, but 

Mr. Dodaro. Well, I will not argue on this one. 

Senator Heitkamp. I think that is the level of frustration that we 
all have here, which is 

Mr. Dodaro. Well, and I have the same frustration. I try to do 
what I can, working with the agencies and the Congress, but we 
need more concentrated focus on this. I mean, our government’s fi- 


^The GAO report submitted by Senator Baldwin appears in the Appendix on page 78. 
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nancial condition is not sustainable over a long period of time and 
we are wasting too much money on these inadequate processes and 
procedures. So, whatever process that you can convince your col- 
leagues to do, I will participate in. 

Senator Heitkamp. Well, it does seem to me that that would be 
a critical kind of component of followup, because the great work 
that you do and actually going out there and identifying these 
problems, identifying the areas of concern, if we do not have a sys- 
tematic process piece to go behind it, we really are only talking to 
each other 

Mr. Dodaro. Right. 

Senator Heitkamp [continuing]. And wringing our hands and de- 
crying the waste of Federal dollars instead of actually fixing the 
problem. 

Mr. Dodaro. Yes. A good model is what we have been doing with 
DHS, for example. When I first met with them, the Deputy Sec- 
retary, they said they really did not know what to do to get off the 
High-Risk List, so I sent them a 29-page letter and specified all the 
things that they needed to do to get off the list. [Laughter.] 

But, to their credit, they said, “OK, we understand now. We 
agree.” They put a corrective action plan together. That plan has 
withstood changes in political leadership over at DHS. I meet with 
the current Deputy and they are making good, steady progress to 
that area. We have informed the Congress of these matters and 
Congress has given some attention. So, most of this stuff, except 
maybe for NASA, it is not rocket science, but [Laughter.] 

And it just requires disciplined follow-up. 

Senator Heitkamp. Well, and it requires some continual over- 
sight that is not sporadic 

Mr. Dodaro. Right. 

Senator Heitkamp [continuing]. That is meaningful. And, I think 
that is to the extent that you guys need us to play bad cop, we are 
way willing to do that. So, we will work on a discussion, I think, 
going back and forth on what that process could be. 

I want to just, in the time that I have left, talk about the IRS 
and talk about what seems to be a systemic failure to institu- 
tionalize processes that would prevent fraud. And, I want to start 
out by saying, obviously, if someone has a W-2 in their hand, there 
is a W-4 somewhere that has been filed with someone relaying this 
information. But, this information, according to Social Security dol- 
lar amounts, is relayed every time there is a payroll, is it not? 

Mr. Dodaro. I am not sure. Jim, do you know? This is Jim 
White, who is our tax expert. 

Mr. White. Some come in throughout the year, but the informa- 
tion that IRS needs to match, they do not have all of that informa- 
tion until after April 15 for the prior year 

Senator Heitkamp. But Social Security has it. 

Mr. White. Social Security 

Senator Heitkamp. When is the W-4 due to Social Security? 

Mr. White. It depends on whether it is paper or electronic, but 
it is due either February or March 

Senator Heitkamp. Give me the date, though. 

Mr. White. Well, some of them are due at the end of February. 
Some are due at the end of March. 
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Senator Heitkamp. So, the employer can have prepared W-2s, 
but transmittal of those W-2s to Social Security does not occur 
until the end of February? 

Mr. White. Correct. And, part of the reason for that is there does 
need to be a window in there for employers to correct errors, so 
they give it to the employee. Sometimes the employees go back. 
There are errors there that need to be corrected. Social Security 
also has an error correction process. And then those go to IRS. 

The other problem is IRS does not have the information systems, 
the computer systems that would allow them to do real-time 
matching. So, that would be another part of this. If the forms came 
in earlier, IRS would need improved computer systems to be able 
to match real time to taxpayers’ tax returns. 

Senator Heitkamp. It is really hard for those of us who deal with 
the complexities of Amazon.com to really believe that in this day 
and age, they do not have real time matching capability. And, so, 
that is something, obviously, that needs to be funded if we are 
going to be serious about fraud detection. 

I want to get to the identity theft, because none of this would 
really solve the problem of someone seizing that Social Security 
number, filing a fraudulent return, and what would be a way that 
we could prevent that if, in fact, the real taxpayer does not file 
until April 15? 

Mr. White. Well, you are right. The crooks file early. They need 
to beat the honest taxpayers’ tax returns. So, they file early. When 
the honest taxpayer files, IRS at that point discovers they have du- 
plicate returns and they know they have a problem. But, they do 
not find out until after they have issued the refund to the crook, 
and at that point, then they are trying to chase the money. 

Senator Heitkamp. Yes. 

Mr. White. So, the solutions — the pre-refund matching, getting 
the W-2s in in time to match to taxpayers’ tax returns before re- 
funds are issued, would put a big dent in the fraud. It is not the 
only solution. 

Another solution 

Senator Heitkamp. That, I do not understand, and I am obvi- 
ously out of time, but if somebody is going to seize that Social Secu- 
rity number and file a fraudulent return, you need to know that 
that is a fraudulent return if you are simply matching it against — 
are you suggesting that because the dollar amounts would vary, 
that would 

Mr. White. Right. 

Mr. Dodaro. Yes. The person perpetrating the fraud really does 
not know what is in the other person’s W-2 

They are just making up the numbers. The other thing that is 
related to this is another recommendation we have. For 54 million 
Americans that are enrolled in Medicare, their Social Security 
number is right on their Medicare card, and we have 

Senator Heitkamp. Yes. Not good. 

Mr. Dodaro. Not good. 

Senator Heitkamp. Mr. Chairman, if I can just ask one more 
question, if we take and actually use old data — by that, I mean old 
numbers, this is your employer on that Social Security number, 
and use the previous tax year, you might actually get at least a 
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bank of those returns that would be incorrect or would not match 
unless that taxpayer changed their status or changed their address 
or changed their job. Would that not be a screening technique we 
could use? 

Mr. White. It is a possible screening technique. The tradeoff 
there is, given the number of Americans that change jobs, change 
home addresses each year, IRS would have millions of false 
positives with that kind of match so they really need current infor- 
mation. 

Senator Heitkamp. I agree, but what I am saying is at least then 
you might be down to 20 percent of those returns that you do not 
know. I mean, I do not think more than 20 percent change jobs or 
change addresses every year. 

Mr. White. Yes, and IRS has made real progress with their filter 
system, so they have caught — they have prevented $24 billion 
worth of fraud because of filters that do some of what you are talk- 
ing about right now. The problem is the $6 billion — it is the $5.8 
billion of fraud that is still getting out the door. 

Senator Heitkamp. Thank you, Mr. Chairman. 

Chairman JOHNSON. Senator Peters. 

OPENING STATEMENT OF SENATOR PETERS 

Senator Peters. Thank you, Mr. Chairman. 

Mr. Dodaro, thank you for your testimony, and for appearing be- 
fore this Committee this morning. I certainly appreciate all the 
work that you have done with your agency in developing a High- 
Risk List that we are discussing today. We are looking for common 
ground in Congress. I think we all can agree that trying to elimi- 
nate fraud, waste, and abuse, mismanagement, those are things we 
should all be able to agree on, focus on, and work to achieve. 

But, as you know, in many cases, there is only so much that a 
Federal agency can do to deal with some of these issues without 
legislation and congressional action, and the GAO has identified a 
substantial number of High-Risk List areas that will many times 
require some sort of legislative action in order to be addressed. 

Last Congress, when I was in the House, I introduced with my 
colleague Cory Gardner, who is now a Senator with me here, legis- 
lation that would have modified some of the House rules, put a 
process in place to require Committees to hold hearings on pro- 
grams, agencies, offices, and initiatives with duplicative goals iden- 
tified by your annual GAO report, which I always find a fascinating 
report. One example I often give, particularly in my district, is the 
example where you have multiple folks that inspect catfish in this 
country. 

Now, I would think we should at least have one government 
agency that regulates catfish. I would agree with that. I like to 
know when I am eating catfish that it is safe and it has been 
raised properly. But, whether or not we need more than one does 
not make a whole lot of sense to me, and oftentimes it is Congress, 
because of different jurisdictions that we have with our Commit- 
tees, that we like to hold on to those jurisdictions, it is Congress 
is the problem here, not just the agencies, as to why we have to 
have that duplication, and I certainly think that we can do better. 
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In the House, I also introduced with another one of my col- 
leagues now, Senator Lankford, who is actually on the Committee 
with me here, a followup to a report that I requested from the 
GAO. I appreciate the reports that I get from you. Your report 
studied the use of remanufactured auto parts in the Federal vehicle 
fleet and found that these parts can reduce operation and mainte- 
nance costs, sometimes significantly. To ensure that the findings of 
this report are available and considered by all Federal fleet man- 
agers, together, we introduced the Federal Vehicle Repair Cost 
Savings Act to encourage all Federal agencies to consider remanu- 
factured vehicle parts, and we are going to continue to work on 
that in this Congress. 

However, the reason I bring this up is I am concerned that too 
many of your GAO recommendations — I have heard that from some 
of the other questions here — are never implemented and Congress 
never follows up on these recommendations. It is Congress, the 
folks right here in this room and other places, that never followup 
on these. 

So, I am going to ask you to be candid. I am going to ask you 
to give us a critique of Congress. In your experience, how effective 
has this body been in actually responding to the incredible work 
that the GAO does? And, again, please be candid, and we will not 
hold it against you. I certainly will not. I know the Chairman will 
not, either. 

Mr. Dodaro. Well, that is good to know. [Laughter.] 

In the overlap and duplication work that we do and issue our an- 
nual report, we actually have a separate scorecard for the Congress 
and a separate scorecard for the Executive Branch in terms of re- 
sponding to the recommendations. And, we found that the Congress 
was responding to the recommendations a tad less, the rate — ^but 
still responding — than the Executive Branch activity. So, on a com- 
parative basis, the Congress’s record was relatively less favorable 
to the Executive Branch, if my memory is correct. I will go back 
and I will give the exact numbers for the record. 

Our next report will be out this April. It will be our Fifth Annual 
Report. So far, we have made 440 specific recommendations for 
change in those areas. But, there is much more that Congress 
could and should do. 

Last time we updated the High-Risk List, I was before this Com- 
mittee and I raised the issue of the need for legislation on the Post- 
al Service. Their business model is broken. They are losing billions 
of dollars. One of the first hearings the Committee held was on the 
Postal Service. I testified at that hearing. The next one was on 
cybersecurity, and eventually, there were bills passed on 
cybersecurity. So, there is a lot more that the Congress needs to 
do in order to rectify these High-Risk Areas and address the over- 
lap and duplication problems. 

If legislation is introduced again along the lines of what you talk 
about, that require hearings in the overlap and duplication area, 
my suggestion would be that it also require joint hearings of dif- 
ferent Committees, because, really, the most difficult problems are 
because of jurisdictional issues in the Congress. 

But, that is not the only problem. The problem is in the Execu- 
tive Branch, too. I mean, they are compartmentalized the same 
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way that the Committees are compartmentalized in terms of juris- 
diction, and I have difficulty getting OMB’s attention to — and 
prioritize, because they only have limited resources — to get the 
agencies to work together or to say, these things ought to be com- 
bined into one function. So, that problem exists in the Executive 
Branch and the Congress, which compounds the difficulty in get- 
ting solutions to those areas. 

That is about as candid as I could be 

Senator Peters. Well, we appreciate that. 

Mr. Dodaro [continuing]. At this point, and thank you for the 
question. 

Senator Peters. Well, I appreciate that, and what I am hearing 
from your answer, and obviously, there are problems in both the 
Executive and Legislative, but as you are saying, with the score- 
card, we actually in Congress perform less than the agencies, 
which is not a good standard for us. We think the agencies should 
be doing a lot more, and if we are behind them, that just shows 
that we have more work to do, and particularly when you are as — 
which is a great suggestion about having the joint hearings to deal 
with some of the turf battles that are there. 

But, I think you would agree, then, that if we introduce bills like 
I have introduced with some of my colleagues here in the House 
and do that here, and putting in place a more formal process that 
forces Congress to deal with this in a formalized way, you think 
that is a good idea? You would support it and encourage it? 

Mr. Dodaro. Yes. And, I would participate. 

Senator Peters. Right. 

Mr. Dodaro. I would be here any day to testify. 

Senator Peters. Great. And be equally as candid. 

Mr. Dodaro. Yes. 

Senator Peters. Thank you, sir. 

Mr. Dodaro. Sure. 

Chairman JOHNSON. Senator Peters, coming from a manufac- 
turing background, I certainly understand, without a good process, 
you do not have a good product. So, I appreciate your enthusiasm. 
I see you are on the Subcommittee under the Government Affairs 
part of this. We will stay engaged. I am looking for low-hanging 
fruit. When we are passing through the Senate, we need six Demo- 
crats joining us. We have seven on this Committee. That is an aspi- 
rational goal. Let us find those areas, and certainly the biggest 
bang for the buck, but also just those areas of agreement. So, we 
are committed to doing that and appreciate your engagement on 
the issue. Senator Ayotte. 

OPENING STATEMENT OF SENATOR AYOTTE 

Senator Ayotte. Well, thank you for your important work. We 
appreciate it. And, I think Ronald Reagan once said, there is noth- 
ing closer to eternal life than a government program. [Laughter.] 

So, one of the things is to followup on Senator Peters’ comments, 
is I am not surprised that we have a low score in terms of when 
it comes to duplication and overlap. In fact. Senator Manchin and 
I have a bill — it is called the Duplication Elimination Act — and I 
hope the Chair might consider taking a look at that bill. Because 
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this issue, as you have identified, is a problem on both ends. It is 
the Executive Branch and it is the Congress. 

And, so, this bill would actually require the President to submit 
to Congress a joint resolution to implement or reject GAO rec- 
ommendations when they are made. And, if they are rejected, let 
us know why. If they are accepted, let us know why and how we 
plan to do it. And then it would require us in Congress to actually 
undertake an expedited review of those and to vote on them so that 
we could adopt things more quickly, because you do excellent work. 
GAO does excellent work and it sits on the shelf too often. The last 
thing we want is to continue funding programs that are not effec- 
tive where we have places we need resources and it is a better allo- 
cation of resources. 

So, I am hoping that might be a bill we might consider making, 
but, basically, we all need a kick in the pants on this, and with 
your help, I hope we can do that, because what ends up happening, 
and I do not need to tell anyone here what happens. I have done 
it. Offer an amendment on eliminating or reforming one program 
on the Senate floor in an appropriations bill, and every program 
has a constituency. So, even if it is underperforming for almost 
every constituent it serves, that one constituency comes to their 
Senator and argues for it and here we are and nothing gets done. 

Well, we need to look at the big picture here, and I know that 
you are doing that and that is important, and so I am glad to hear 
Senator Peters focus on this, because this is a bipartisan issue. It 
is really — the Chairman, as well. And, I thank you because the 
work you are doing is excellent. 

I wanted to followup on the VA issue, because for New Hamp- 
shire, on the Choice Card issue, we are getting, as a State that is 
one of the States that does not have a full-service Veterans Hos- 
pital, the Choice issue in the veterans bill is very important to my 
State. So, what I am hearing from people in New Hampshire is 
that the third — the Choice Card is being processed through a third- 
party contracting agency and that we have veterans calling the of- 
fice essentially saying that there is not enough information being 
given to veterans, that veterans are saying that they want to — if 
a veteran comes to you and says, “I want to see a particular doc- 
tor,” that might allow them to go and connect the veteran with the 
doctor. It may or may not. That has been complicated on that end. 
But, also, that if the veteran just says, “I need this service,” they 
are sort of left hanging. 

And, one, I wanted to get your thoughts are, is one of the things 
that was identified on the veterans’ end in the report that you 
issued is the provision of non-VA care. So, in a State like mine, it 
is really important, because we do not have a full-service Veterans 
Hospital. It is addressed in the bill. So, we are giving our veterans 
access to more non-VA care. Are you going to do further work on 
this non-VA care issue, because Congress clearly shifted and ex- 
pressed a preference to introduce more opportunities for our vet- 
erans in it. It seems to me, though, that the Veterans Administra- 
tion has been really resistant to reform. And, we talk about access 
in veterans facilities, but they seem somewhat resistant in terms 
of informing veterans on what their rights are on the non-VA care. 
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And, so, I wanted to get your thoughts on what further work we 
think we need to do on this provision of non-VA care. How do we 
get this, the Veterans Administration, to stop being so resistant to 
reform, because Congress has clearly expressed on a bipartisan 
basis it is about the veteran and we want to make sure that we 
get them proper care. 

Mr. Dodaro. Yes. Well, I would just say that we will do the work 
necessary in the future to make sure that this issue gets resolved 
satisfactorily. Debbie Draper is our expert in this area. I would like 
her to speak to the issues that need to be resolved. But, in putting 
this area on the High-Risk List, a couple areas I was really trou- 
bled by. One was the fact that VA does not followup to make sure 
if there is a referral that it actually happens, and they do not have 
good information to know whether it is more economical 

Senator Ayotte. Right. 

Mr. Dodaro [continuing]. To give VA care or non-VA care. 

Senator Ayotte. So, what makes me worried about all this is I 
hear it, because for New Hampshire, really important, and the 
issue is this, is that if the VA almost wants to — I mean, I do not 
want them to want to undermine the access to non-VA care, be- 
cause if we have good data, we may find down the line that this 
is actually a better way to serve veterans, to avoid wait lists, and 
the cost efficiencies may be there. But, if they do not follow through 
on this, it is almost a self-perpetuating failure 

Mr. Dodaro. Yes. 

Senator Ayotte [continuing]. Which is contrary to what Con- 
gress wanted to happen in the reform bill. So, I appreciate your 
being here. 

Ms. Draper. Yes, we have several concerns. I mean, before the 
Act was passed, we had done prior work looking at non-VA care 
and we found that the payment to providers was slow or often inac- 
curate and community providers were really unwilling to take some 
of the VA patients. 

But, beyond that, it was intended to improve access to health 
care, the timeliness of care. However, there was no infrastructure 
in place to really monitor wait times, how long people are actually 
waiting to get into those community providers. So, we do have a 
number of concerns and that is one of the reasons that we put VA 
health care on the High-Risk List. 

Many people see this as a panacea for some of the access prob- 
lems. I think there is a lot of work that needs to be done to make 
sure that the infrastructure is in place, to make sure that people 
are actually getting timely care through that system. And, I think 
another important point is the VA Health Care System is a dif- 
ficult system to navigate. So, now you are introducing a second sys- 
tem for someone to navigate. So, it just compounds the problems 
that exist or could exist. 

So, we do have a number of mandates under that Act to really 
look at the issue. So, we will be doing that over the next couple 
of years, looking at the non-VA care. 

Senator Ayotte. I think it is really important, and I hope that 
you also look at, as you look at this, how embracing has the VA 
been of access to non-VA care, because, again, I worry that if the 
VA does not embrace giving veterans access to non-VA care, then 
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you can basically ensure that it really does not give veterans that 
option and it really becomes self-perpetuating in terms of the con- 
clusions that can be drawn from it. 

And, for veterans in New Hampshire, for example, they were on 
buses being shipped to Massachusetts and other places. If they can 
go to a local provider in their community, which, obviously, people 
have been able to do through other Federal programs, then that, 
in the end, if you look at the cost efficiencies of not paying for the 
transportation, of access to care in terms of quality — now, not ev- 
erything is going to fit in that category, but a lot of care can. 

So, I am hopeful, in the long term, that we are not just allowing 
the VA to want to perpetuate their own system, but we really do 
look at what is best for the veterans. So, I know that you can be 
a very important voice on this. Thank you. 

Ms. Draper. And, just one other thing. I think we have seen a 
lot of variation, as we do with most other things related to VA, 
about how each facility is handling the non-VA care. And, so, that 
is something that, again, there are not standardized processes, and 
they also rolled out this program very quickly, so over a couple 
months. Choice Cards were mailed to veterans 

Senator Ayotte. Yes, and they were not told anything about 
them and they were, like, all contacting our office. So, information, 
I think, is important, as well. 

I know I have gone over my time. I have a couple of additional 
questions that relate to the IRS and also the Earned Income Tax 
Credit (EITC) and Additional Child Tax Credit (ACTC) tax pay- 
ments that I will submit for the record. I appreciate all that you 
do. Thank you. 

Chairman JOHNSON. Thank you. Senator Ayotte. 

I think you can tell by the number of questions, by the depth of 
the concern, how much, first of all, we appreciate the fact that you 
are highlighting the problems in the VA, and so you can, again, 
rest assured, you will have support and we will continue to be fully 
engaged, which is certainly what you mentioned in terms of the 
process to make sure these reforms are implemented across your 
High-Risk List. 

You will have full engagement by this Committee on all the 
items, but in particular, that you can rest assured that the VA sys- 
tem is going to be a top priority of this Committee. 

Just real quick, I do want to followup on IT acquisition. I have 
been meeting with the different agency heads within DHS and I 
am pleasantly surprised by the repeated, I guess, assurance that 
they are starting to look more at off-the-shelf solutions as opposed 
to having the government specify something and have through gov- 
ernment contract, trying to have some IT solution created specifi- 
cally for the government, which is not particularly efficient. Are 
you finding that not only within DHS, but is that a reoccurring 
theme? Is that something you support, or are there any dangers to 
that? 

Mr. Dodaro. Well, we have long said that commercial solutions, 
and even if you have to change your business process a bit, are 
more efficient than customized software development. So, that has 
been something we have been emphasizing over time to agencies. 
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Dave Powner is our expert in the IT area and he has a good van- 
tage point, across government, so I will ask him to elaborate on 
that. 

Mr. Powner. Yes, Senator Johnson. If you look at commercial so- 
lutions, that actually is one area you should look at instead of 
building. That is buy. There are a couple of things in our High-Risk 
Area that endorse that. If you look at incremental development, if 
we go with smaller, quicker deliveries, commercial solutions will be 
considered more heavily. 

The other area is cloud computing. We need to look more at cloud 
solutions and have providers actually provide those services to 
agencies instead of always building them and go more to the cloud. 
So, I think with commercial, both incremental and the cloud solu- 
tions, which is emphasized in our High-Risk Area, will be quite 
helpful. 

Chairman JOHNSON. Well, thank you. Again, I am really encour- 
aging that. Coming from the private sector, I never liked rein- 
venting the wheel, so it just makes perfect sense. 

Before we conclude the hearing, I do also want to just touch a 
little bit on cybersecurity. Our first hearing was on cybersecurity. 
That is a top priority of this Committee, is that first step. Can you 
just speak to the privacy that Americans are going to lose if we do 
not address this problem? Again, part of the reason we have not 
been able to pass cybersecurity legislation is because we have not 
been able to provide the liability protection to facilitate the needed 
exchange of information within the private sector, the private sec- 
tor to the government, and back down. 

And, again, there are legitimate concerns of privacy. But, one of 
the points I tried to make in the hearing and I think we need to 
underscore, and I just want to get your comment on it, if we do not 
take that first step, if we do not allow that information sharing, 
which does allow us to share that threat signature which can pre- 
vent attacks — it is not a panacea. It is not going to protect every- 
thing. But, the more attacks we can prevent, we are protecting 
Americans’ privacy. Can you just comment on that? 

Mr. Dodaro. First of all, I think people need to understand that 
the amount of information that is collected, disseminated, and 
stored in the Internet by most projections is expected to double and 
triple every 2 years going forward. So, you have a tremendous 
amount of information available now, but the storage capacity is — 
such that so much more information is going to be collected and it 
is going to be shared and disseminated, including personally identi- 
fiable information, over time. 

The only way to deal with this, and we have been advocating 
sharing, partnerships with public-private sector for many years 
now, since we have been focused on this area, and people have to 
understand that the best safeguard is continuous monitoring and 
diagnostics and preventing these events from occurring. 

Greg Wilshusen is our expert in this area. I will ask him to 
elaborate on it. But, we will do whatever we can to help people un- 
derstand that information, more information is going to be avail- 
able. The question is how best to protect that from getting into un- 
authorized hands and information sharing is a critical component 
of that protection. 
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Chairman JOHNSON. I would also, quickly, like to point out that 
every time you agree to the privacy statement of an application, 
you are giving up so much information that is widely disseminated 
in the private sector, and so people need to also understand that. 

Sir. 

Mr. WiLSHUSEN. Yes. And, I would just like to say, too, that the 
need for sharing information, particularly about actionable 
cyberthreat information and incident information, is really critical 
to help better protect our critical infrastructures. 

A couple years ago, we did a report which identified among our 
private sector partners that they said that their expectations of the 
public-private partnership for protecting critical infrastructure, 
that 98 percent of them indicated that receiving actionable 
cyberthreat information and incident information from the Federal 
Government was of a great need for them. However, only 27 per- 
cent of the respondents to our survey, who were the critical infra- 
structure owners and operators, said that they were actually re- 
ceiving that type of information to a satisfactory degree from the 
Federal partners. So, it is critical that the information sharing 
processes be improved. 

Chairman JOHNSON. One of the hangups always has been that 
liability protection, and I am not the person to say exactly what 
that liability protection ought to be, but I can say that the metric 
is going to be if we pass something with liability protection, the 
success or failure is whether or not that information actually is 
shared. I mean, can you speak a little bit in terms of the reluctance 
of private sector companies to share the information the threats 
they really do feel in terms of lawsuits if they share that informa- 
tion, and the reluctance, as a result, to share it without really 
strong liability protection. 

Mr. WiLSHUSEN. Well, certainly, I think, liability protection is 
one of the areas that is an inhibitor to some of the private sector 
companies. Our reviews have also shown is that often when private 
sector companies do provide information to their Federal counter- 
parts, they do not really receive anything in return. It is like giving 
this information and there is not really getting much in return for 
that. So, they are somewhat of a disincentive to provide that infor- 
mation. 

In addition, it is not always clear. They want to make sure that 
the information they do provide is sufficiently anonymized in order 
to allow it to be used by government agencies in an appropriate 
manner and not necessarily be shared with others. 

Chairman JOHNSON. Let me talk about that personal informa- 
tion. In terms of preventing further attacks, in other words, that 
threat signature, there is really no reason to have personal infor- 
mation attached to that information that is shared, correct? 

Mr. WiLSHUSEN. I would say, generally, that would be the case. 

Chairman Johnson. But, if you actually want to solve the crime, 
if you want to trace back, where did that hacking come from — 
which, quite honestly, to prevent further attacks, it would be awful 
nice to find out who these bad actors are, who the criminals are — 
that is where you need some personal information, potentially. How 
much can we limit that? 
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Mr. WiLSHUSEN. Well, part of the what you would need would be, 
for example, the IP addresses from which these attacks are origi- 
nating. And, so, while that may not be considered personally identi- 
fiable information, it is a key part of trying to trace attacks and 
the sources of those attacks. 

Chairman JOHNSON. OK. Oh, Senator Carper is back. He has re- 
turned. I have no further questions. Senator Carper. 

Senator Carper. Thanks so much. 

Some days are busier than others. This is a day where, when my 
train finally got here, I had the opportunity to participate with you 
and Senator Johnson and others in a press conference announcing 
the updated list the High-Risk List. And then we have almost si- 
multaneously a markup and we are voting on legislation, part of 
which I authored, in the Finance Committee, and defending, and 
the Environment and Public Works Committee is having a hearing 
as we speak on clean air legislation, which is very important to my 
State, which is threatened by rising seas, and this important hear- 
ing. So, there is a lot going on. People from Delaware want to see 
me. And, so, I apologize for being in and out. 

People sometimes say to me, I do not know if they say to Ron, 
but they say, “Can we come to Washington and meet with you?” 
And, I say, my life here is frenetic. Why do we not meet in Dela- 
ware? I go there every night. But, thank you for bearing with us. 

I want to ask you a question about the Federal workforce, but 
before I do, let me preface it by making this observation. One of 
the pieces of cybersecurity legislation that this Committee adopted, 
reported out, and was ultimately signed into law by the President 
was one that strengthens the ability of the Department of Home- 
land Security to hire people, well-qualified people, to better enable 
them to help defend not only the Federal dot-gov world, but also 
to help businesses, the private sector and others, to defend their 
personally identifiable information, their intellectual property, and 
to give the Homeland Security Department actually the ability to 
do some of the hiring and retention for employees that they have 
not been able to do. 

When I was Governor of Delaware, we used to lament the fact 
that on IT projects, we would hire people to work in the IT world 
for us, train them, they would become better and more proficient, 
and then they would get hired away. And, the same kind of thing 
actually happens with the Department of Homeland Security with 
their cyber warriors and they have asked for the tools to enable 
them to hire good people, retain people, and we have done that, 
and I am pleased the President has signed that. It is one of three 
or four pieces of legislation that has actually come through this 
Committee, signed into law last year, that will strengthen our 
cybersecurity. 

But, with respect to the Federal workforce, as your report high- 
lights, there are gaps in mission critical skills in the Federal work- 
force and they have significant impact on many of the high-risk 
issues. Unfortunately, efforts to identify and address current and 
emerging critical skill gaps have been slow and not fully successful. 
Addressing these gaps needs to be a priority, given their impact on 
so many important issues facing our country. 
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Let me just ask what strategies you think have been most suc- 
cessful. What strategies have been most successful in identifying 
and addressing those skill gaps, and how can we help to ensure 
that the Office of Personnel Management — and other agencies, 
too — are using the best strategies and giving this issue the focus 
that it deserves? 

Mr. Dodaro. First, I think the efforts need to recognize the skill 
gaps. I mean, we have pointed out this to a number of agencies and 
it is almost like they are not identifying them proactively on their 
own as much or using available authorities for retention and re- 
cruitment that could be used in the process. So, the first thing is 
sort of an awareness they have an issue, and also planning ahead 
for the future to be able to do this. At the same time you have crit- 
ical skill gaps, you also have succession planning problems 
throughout the Federal Government because of the retirement of 
the Baby Boom generation. So, you have a dual problem that needs 
to be dealt with. 

Chris Mihm is our expert in these areas. I will ask him to elabo- 
rate on some specific best practices. But, this area worries me as 
much as any on the list because it really goes to the heart of the 
government’s ability to effectively function, and you cannot do it 
without the right people, whether you are talking about petroleum 
engineers and making sure we are getting our right oil and gas es- 
timates, cost estimating expertise at NASA, the right people in a 
lot of these different departments and agencies, cybersecurity you 
mentioned. So, it is a real critical issue. I am glad that you asked 
the question. 

Senator Carper. All right. Thank you. 

Mr. Dodaro. Chris. 

Mr. Mihm. Thank you. Senator. I agree very much with the pref- 
ace of your question, that many of the High-Risk Issues that we 
find, a root cause of that is a critical skills gap in agencies. You 
had a discussion this morning about the problems over at VA. One 
of the five areas that you have heard about is a skills gap issue 
associated with training of staff over there. Skills gaps are cer- 
tainly a big part of the acquisition area, in the acquisition work- 
force, notwithstanding an awful lot of attention that Congress and 
other agencies have given to that. The IT area, as you referenced 
in your question. 

When we see the successful efforts to get at this, it is actually 
the two things the Comptroller General just mentioned. First, it is 
heavy use of data analytics. There is a wealth of Federal personnel 
information that is in our personnel files that is not being effec- 
tively mined. We talk all the time about big data. One of the big 
data things that we are not effectively exploiting is Federal per- 
sonnel information, stripping out all the PII, of course. But, it can 
tell about career paths and training and development and exactly 
what are the succession planning challenges that an agency should 
be expecting. So, mining this big data that is out there on Federal 
personnel is one of the first key steps. 

The second, as the Comptroller General also mentioned, is really 
effective strategic human capital planning. All too often in agen- 
cies, we go in and they seem to have a succession planning ap- 
proach that goes under the very inelegant name of what is called 
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“truck sensitive,” meaning if a truck hit the person, they know who 
is next in line. They are not thinking very far 

Senator Carper. I like that, truck sensitive. 

Mr. Mihm. Well, unless you are the one that is being hit on. 

Senator Carper. Senator, what did you get out of your hearing 
today? Well, truck sensitive. 

Mr. Mihm. Well, here to contribute. 

Senator Carper. Among other things. [Laughter.] 

Mr. Mihm. Well, but they are not thinking, what are the knowl- 
edge and skills that we are going to need to be effective 5, 10, and 
even 15 years in the future. We need to start recruiting on that 
now. We need to start training based on those skills now. We need 
to start developing those skills now. We cannot have a government 
where the working assumption is, the key to our future success is 
to be more like we are today. Many of the personnel systems that 
we have, certainly the human capital planning systems, seem to be 
implicit on that, is that if we just hire the same people that were 
just like us, we are going to be successful in the future. That is not 
going to be workable in the context that we face today. 

Senator Carper. All right. Thank you. 

Last question and I will make it real quick and I will ask for a 
short answer. This year’s High-Risk Report discusses improvement 
in a number of High-Risk Areas. We are grateful for that. Unfortu- 
nately, no issues, I think, were removed from the list from last 
year. Are there issues on the list that you think are within striking 
distance of being removed from the list, maybe, by 2017? And, for 
those issues, are there any things that come to mind that you think 
are the final reforms that are needed? Just touch on one or two, 
if you would. 

Mr. Dodaro. Sure. I am very pleased with the progress that we 
have made working with NASA on their acquisitions area. The big 
challenge now is to get as many people trained up as possible in 
their cost estimating and using Earned Value Management tech- 
niques and issues. 

The big hang-up we have had with NASA is to agree on an ap- 
proach to evaluate the design sophistication of their technology and 
the stability of it early in the process, before it develops along time, 
and they have implemented that for a number of their smaller 
projects. The big issue will be, can they extend that on their big 
major projects, like the James Webb telescope, the Space Launch 
System, the Orion capsule. So, we have been working with them. 
But, they have met, right now, three of the five criteria and they 
have top-level attention. They have a good plan. The question is 
whether they can execute over a period of time. 

I also believe the Department of Homeland Security is within 
this if they stay the course in those areas. They really have to im- 
prove their acquisition area, though. I am really concerned about 
that. That is one that they have been late in implementing. And, 
they have to improve their internal controls environment and deal 
with their morale issues over there. I mean, those are three. You 
need a workforce that is more engaged and feeling better about 
themselves to be successful over a period of time. You cannot have 
the situation that they have right now and be successful. No busi- 
ness would be successful with that level of dissatisfaction and no 
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government agency will, as well. But, so, there are challenges there 
in those areas. 

So, those are two that I would mention off the top of my head 
that are successful and, I think, doable within a reasonable period 
of time. 

Senator Carper. Good. Mr. Chairman, I would just say that, in 
closing, what Gene has said reminds me oh how important the 
work is we have done to try to vet and clear and send on to the 
Senate the leadership team that the President has asked for and 
Jeh Johnson has asked for in that Department. There is one more 
that we are working on, a fellow named Russ Deyo, who we have 
a lot of respect for. He has been nominated for the No. 3 position 
there, for management, and it is critically important that he be 
there. 

I will close with — you mentioned NASA, and Mr. Chairman, you 
may have heard this story, and Tammy, you may have heard this 
story. A friend of mine was going through visiting NASA one night. 
Most of the people had left and gone home for the day. This one 
guy was still there working, and he was the janitor. And my friend 
said to him, “What do you do here? What is your job?” i^d, the 
man said, “I am helping to put a man on the moon.” 

The folks that are working at NASA to help make sure that they 
cleanup their performance with respect to high-risk, they are help- 
ing to put men and women not on the moon, but all over the galaxy 
and to do good things for our country. So, that is kind of making 
it real. Thanks so much. 

Chairman JOHNSON. Well, we certainly share that commitment 
to make sure the agencies have the best people working for them, 
and I continue — I have said this repeatedly — I am very impressed 
with the people who work for the Federal Government. Senator 
Baldwin. 

Senator Baldwin. Thank you, Mr. Chairman, Ranking Member. 
I did not expect to have a chance to return from the Budget Com- 
mittee, but, indeed, I am here, and I appreciate the chance for an- 
other opportunity to ask a question that I was going to submit for 
the record. 

GAO found that local VA facilities are carrying out processes in- 
consistently, including those dealing with the provision of medical 
care. A GAO report from November 2014 found that about 10 per- 
cent of veterans who received health care services through the VA 
were diagnosed with major depressive disorder, and of those, 94 
percent were prescribed an antidepressant. VA policy states that 
antidepressant treatment must be consistent with the VA’s current 
clinical practices guideline. However, the GAO’s review of medical 
records identified deviations from those guidelines for most vet- 
erans reviewed, and I will quote the report now. “As a result, VA 
does not know the extent to which veterans with major depressive 
disorder who have been prescribed antidepressants are receiving 
care as recommended in the clinical practice guidelines and, wheth- 
er appropriate actions are taken by VAMCs to mitigate potentially 
significant risks to veterans.” 

In other words, the VA does not know if veterans with severe 
mental illnesses are getting the correct care. This is completely un- 
acceptable, and I am extremely concerned that the VA may have 
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a similar blind spot regarding the appropriate standard of care for 
mental health patients at the Tomah VA, as I have outlined earlier 
today. 

Indeed, in a tragic example last August, former Marine Jason 
Simcakoski died as an inpatient at the Tomah facility from mixed 
drug toxicity. At the time of his death, he reportedly was on 15 dif- 
ferent prescription drugs, including antipsychotics, tranquilizers, 
muscle relaxants, and opioid painkillers. There are serious ques- 
tions as to whether Mr. Simcakoski was receiving the correct 
standard of care, and your reports would indicate that the VHA’s 
mental health treatment programs, including the drugs prescribed 
to patients, are deeply flawed. 

So, I would love it if you could take a moment to explain these 
findings from the November 2014 GAO report in further detail and 
provide recommendations regarding how the VHA can fix this prob- 
lem as soon as possible. 

Mr. Dodaro. Debbie. 

Ms. Draper. Sure. We looked at a sample of medical records 
from six different VA Medical Centers and we did find exactly what 
you had talked about, and I think this really still gets at the issue 
of why we are putting VA Health Care on the High-Risk List. 
There are issues around oversight and accountability. Training is 
an issue, looking at how practices play out at the local level. Again, 
there are inconsistent processes and ambiguous policy. 

So, in this report, we did make a number of recommendations to 
VA, and one was to implement processes to review the data and as- 
sess deviations from recommended care, because it was a large 
number of the records that we reviewed, they deviated from the 
clinical practice guideline, and that included things like a nec- 
essary initial review of the situation and then a followup review. 
Those were not conducted as they were outlined in the clinical 
practice guideline. 

We also made recommendations — ^because in that same report, 
we looked at the template that was used to complete information 
about suicides and that information was also found to he incom- 
plete. So, what happens is that it really diminishes VA’s ability be- 
cause they do not have complete data when they develop processes 
or initiatives on suicide prevention. So, we made a number of rec- 
ommendations related to ensuring the completeness of that infor- 
mation, as well. 

Chairman JOHNSON. Thank you. Senator Baldwin. 

Mr. Dodaro, again, thank you and all of the associates from the 
GAO that have come here and provided some good information for 
all your good works. You can tell by the level of attendance at this 
hearing, you can tell by the level of engagement — it might be an 
overstatement, but this is this Committee’s favorite agency. You do 
so much good work, and we truly appreciate that. 

From my standpoint, one of the major take-aways, of course, is 
we are going to be supportive of making sure the recommendations 
of the VA get implemented as quickly as possible. But, also, we are 
looking at what we can do to develop a process to ensure imple- 
mentation of as many of your recommendations, or all of your rec- 
ommendations, across the agency. So, we want to work very closely 
with you on that process. 
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I was handed an interesting little fact. I talked about how you 
actually were suffering budget cuts. I guess last year, GAO had the 
fewest number of employees since World War II. Now, the Federal 
Government has kind of grown a little bit since World War II, so 
I think we would like to give you some more resources and some 
more associates to continue your good work and expand it so we 
can implement your recommendations. 

So, again, thank you for your testimony. Thank you for all your 
good work. 

This hearing record will remain open for 15 days, until February 
26 at 5 p.m., for the submission of statements and questions for the 
record. 

Senator Carper. Mr. Chairman, just one quick closing comment. 
If you read the Preamble — in fact, we all learned it as kids in 
school, the Preamble to the Constitution — and one part of it says, 
“In order to form a more perfect Union” — “In order to form a more 
perfect Union.” It does not say, “In order to form a perfect Union,” 
but it does say, “In order to form a more perfect Union.” 

What you and the folks that are sitting there behind you in the 
front rows of this hearing room are trying to do is to help us form 
a more perfect Union. We know we will never be perfect. But we 
strive for perfection, because we know everything that we do, we 
can do better. 

This is a team sport. You are critical members of the team. We 
like to think that we are, as well. Others within the agencies 
spread across the government, the President, 0MB, we are all 
members of the team, and it is important that we pull together in 
the same direction, because if we do, some amazing things can hap- 
pen. In fact, they already have, and we need more of that. Thank 
you so much. 

Mr. Dodaro. Thank you very much. 

Chairman JOHNSON. Thank you. Senator Carper. 

In manufacturing, good operations always engage in continuous 
improvement. GAO helps the government continuously improve, so, 
again, we thank you. 

This hearing is adjourned. 

[Whereupon, at 12:01 p.m., the Committee was adjourned.] 
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Opening Statement of Chairman Ron Johnson 
“Risky Business: Examining GAO’s 2015 List of High Risk Government Programs” 
Februai-y 11, 2015 


A.s' prepared for delivery: 

Good morning and welcome. 

This morning, the Government Accountability Office (GAO) released an update to its 
list of “High Risk” government operations, GAO has put out a High Risk Report at the 
beginning of every new Congress since 1990 to inform our oversight and legislative agenda and 
to focus national attention on the most pressing problems facing the federal government. 

The pressure to transform agencies and programs designated as high risk has a real, 
measurable benefit to the taxpayer. By holding hearings like this one, and through follow up 
oversight and legislation to address the problems highlighted in this report, we have the potential 
to save tens of billions of dollars. 

Over the last two years, GAO estimates that Congressional and Executive Branch 
attention to the high risk areas has saved $40 billion. 

The 20 1 5 High Risk Report contains an important new high risk area: veterans’ health 
care. It is obvious to all of us that there continue to be serious problems with the government’s 
ability to provide health care to our nation’s veterans. Back home in Wisconsin, these problems 
are becoming increasingly evident with new reports coming in every day. While there are many 
public servants at the VA who do their best to provide quality care to our nation’s heroes, it is 
clear that a lack of oversight a,nd longstanding bureaucratic mismanagement has led to the 
systemic problems that have pul our veterans at risk. 

'Fhc work GAO has done to not only bring these issues to the national stage, but to also 
work year-round behind the scenes with federal agencies to actually sUirt the process of fixing 
these problems deserves our highest praise. 

I look forward to hearing from the head of GAO, Comptroller General Gene Dodaro, 
about what wc in Congress can do to address these longstanding problems through legislation 
and oversight. 
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Opeeing Statement of Ranking Member Thomas R. Carper 
“Risky Business: Examining GAO’s 2015 List of High Risk Government Programs” 

February 11, 2015 


Js prepared for delivery: 

Last November, the voters went to the polls and sent us a clear message. They want the 
Members of Congress to stop bickering, come together to solve problems, and help 
continue our economic recovery. That’s exactly what we’re doing here today. We’re 
coming together to talk about how we can solve the problems that the Government 
Accountability Office (GAO) is naming today as the ‘highest-risk’ for our government, 
wdiich I have long considered Congress’ ‘to-do’ list. 

What GAO means is that if we don’t solve these problems, the taxpayers are exposed to a 
high level of waste, fraud or abuse, which can cost our government billions of dolla.rs 
every year. GAO’s report also points to needed reforms in many critical government 
operations that provide for the security, health and safety of the American people. 

We can solve all the problems on the High Risk list. But it is a shared responsibility. 
Congress must leverage the good work of GAO and the Inspectors General across the 
government, and work closely with the Office of Management and Budget and the 
agencies responsible for these programs, 

GAO’s report being released today shows that kind of strategy is working in several High 
Risk areas. In fact, GAO reports that 18 of the 30 areas on the 2013 list have shown 
improvement. This includes progress in areas that we’ve worked on in this Committee, 
specifically cybersecurity, the sharing of information on terrorist threats, and the 
management of the Department of Homeland Security, Progress noted by GAO also 
includes the Department of Defense’s management of its contracts and major weapons 
systems acquisitions. 1 am pleased that GAO has found solid progress in all these areas. 

However, we still have much work to do on these and other High Risk areas. There are a 
lot of what I cal! ‘repeat offenders’ on the list - for example, waste and fraud in Medicare 
and Medicaid, chronic financial management problems at the Department of Defense, 
longstanding challenges in recruiting needed skills into the federal workforce, and the 
government’s incredibly wasteful management of federal property. 

These items’ continued presence on the list is obviously disappointing and troubling, but 
it also underscores the urgent need to provide strong oversight, and work with the 
Administration to develop and implement solutions to address these risks. 

I also want to point out that there are two new items on the High Risk list. One is an issue 
that has long been at the forefront of oversight and legislative attention from this 
Committee. That is the acquisition and management of information technology by the 
government. Last year I worked closely with Dr. Coburn, then-Chairman Issa and 
Congressman Connelly to enact the Federal Information Technology Acquisition Reform 
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Act, FITARA. FITAR A will strengthen the roles of Chief Information Officers across the 
government and will give them better tools to manage IT investments. I now will work 
closely with Chairman Johnson and our House colleagues to make sure that FITARA is 
implemented properly. 

And as all Americans know, there are many serious problems with the health care that the 
federal government delivers to our nation’s veterans. It is no surprise that GAO is adding 
this to the High Risk list. Last year. Congress came together and passed legislation to 
address the immediate problem of veterans having to wait too long to access care through 
the Veterans Administration. However, much more remains to be done to ensure that 
veterans get timely, high-quality, and cost-effective health care. Our veterans deserve no 
less. 

I want to close by emphasizing the clear role that Congress must play in these High Risk 
areas. Federal agencies need adequate resources and, in many cases, new authorities 
from Congress to be able to tackle these problems. I can’t think of two better examples 
than two that are at the top of my agenda for this Congress - restructuring the U.S, Postal 
Service and funding the nation’s surface transportation system. It is up to Congress to act. 

I thank Gene Dodaro, our Comptroller General of GAO, for the hard work that he and his 
team have done to put together this year’s ‘High Risk’ list. The release of this list every 
two years is always sobering, because it’s a reminder of the many serious challenges that 
face our goverament, But I also find that the release of the report serves as important 
encouragement to the executive branch and Congress because the report highlights the 
progress that is being made, and shows the path for further progress. So, Mr. Dodaro, 

I’m ready for you to give us our ‘to-do’ list, and Mr. Chairman, I know we are going to 
have a productive Congress and make great progress in making the High Risk list a 
shorter list. 


### 
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Senate Homeland Security and Government Affairs Committee 
Full Committee Hearing - Risky Business Examining GAO’s 2015 List of High Risk Government 

Programs 

Statement for the Record 
Senator Joni Ernst 
February 1 1, 2015 


Chairman Johnson and Ranking Member Carper: 

Thank you for holding this important hearing on our government’s most vulnerable programs. Oversight 
of our federal programs is a role 1 take seriously. I look forward to w'orking with my colleagues on both 
sides of the aisle to ensure we are spending taxpayer dollars judiciously, and are improving the efficiency 
and management of these programs. 


Unfortunately, I was unable to stay to ask questions of the witnesses due to commitments at a Senate 
Armed Services Committee hearing on the current situation in Afghanistan. However, I will be 
submitting questions for the record. 

Thank you. 
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Highlig hts 

i-iighlights of GAO-1 5-371 T. a statement 
before the Committee on Homeianc! Security 
and Governmental Affairs, U.S. Senate 


Why GAO Did This Study 

The federal government is one of the 
world’s largest and raost complex 
entities; about $3.5 trillion in outlays in 
fiscal year 2014 funded a broad array 
of programs and operations. GAO 
maintains a program to focus attention 
on government operations that it 
identifies as high risk due to their 
greater vulnerabilities to fraud, waste, 
abuse, and mismanagement or the 
need for transformation to address 
economy, efficiency, or effectiveness 
challenges. 

Since 1990,. more than one-third of the 
areas previously designated as high 
risk have been removed from the list 
because sufficient progress was made 
in. addressing the .problems identified. 
The five criteria for removal are; (1) 
leadership commitment, (2.) agency 
capacity, (3).an action plan, (4) 
monitoring effo'rtSi and'-(5) 
demonstrated progress, 

This biennial update:describe$ the 
status of high-risk areas listed in 2G13, 
and identifies new.' high-risk, areas . - / ^ 
needing attention by Gdngress and the 
executive branch, Solutions to high-risk 
problems offer (he potential to save 
billions of doliars, Improve, service to. 
the public, and strengthen-government 
performance and accountability. 

What GAO Recommends 

This report contains GAO’s views on 
progress made and what remains' to be 
done to bring about-lasting solutions 
for each high-risk area. Perseverance 
by the executive branch in , 
implementing GAO's recommended 
solutions and continued oversight and 
action by Congress are essential to 
achieving greater progress. 


View GAO-15-371T. For more information, 
contact J, Christopher Mihm at (202) 512-6806 
ormihm)@gao-gov 


HIGH-RISK SERIES 

An Update 


What GAO Found 

Solid, steady progress has been made in the vast majority of the high-risk areas. 
Eighteen of the 30 areas on the 2013 list at least partialiy met ai! of the criteria foi 
removal from the high risk list. Of those, 1 1 met at least one of the criteria for 
removal and partially met all others. Sufficient progress was made to narrow the 
scope of two high-risk issues — Protecting Public Health through Enhanced 
Oversight of Medical Products and DOD Contract Management. Overall, 
progress has been possible through the concerted actions of Congress, 
leadership and staff in agencies, and the Office of Management and Budget, 

This year GAO is adding 2 areas, bringing the totai to 32. 

• Managing Risks and Improving Veterans Affairs (VA) Health Care. GAO 
has reported since 2000 about VA facilities’ failure to provide timely health 
care. In some cases, these delays or VA’s failure to provide care at ai! have 
reportedly harmed veterans. Although VA has taken actions to address some 
GAO recommendations, more than 100 of GAO’s recommendations have not 
been fully addressed, including recommendations related to the following 
areas: (1) ambiguous policies and inconsistent processes, (2) inadequate 
oversight and accountability, (3) information technology challenges, (4) 
inadequate training for VA staff, and (5) unclear resource needs and 
allocation priorities. The recently enacted Veterans Access, Choice, and 
Accountability Act included provisions to help VA address systemic 
weaknesses. VA must effectively implement the act, 

• improving the Management of Information Technology (iT) Acquisitions 
and Operations. Congress has passed iegisiation and the administration 
has undertaken numerous initiatives to better manage iT investments. 
Nonetheless, federal IT investments too frequently fail to be completed or 
incur cost overruns and schedule slippages while contributing little to 
mission-related outcomes. GAO has found that the federal government spent 
billions of dollars on failed and poorly performing IT investments which often 
suffered from ineffective management, such as project planning, 
requirements definition, and program oversight and governance. Over the 
past 5 years, GAO made more than 730 recommendations: however, only 
about 23 percent had been fully implemented as of January 201 5, 

GAO is also expanding two areas due to evolving high-risk issues. 

• Enforcement of Tax Laws. This area is expanded to include IRS's efforts to 
address tax refund fraud due to identify theft, IRS estimates it paid out $5.8 
billion (the exact number is uncertain) in fraudulent refunds in tax year 2013 
due to identity theft. This occurs when a thief files a fraudulent return using a 
legitimate taxpayer's identifying information and claims a refund. 

• Ensuring the Security of Federal Information Systems and Cyber 
Critical Infrastructure and Protecting the Privacy of Personally 
Identifiable Information (Pll). This risk area is expanded because of the 
challenges to ensuring the privacy of personally identifiable information 
posed by advances in technology. These advances have allowed both 
government and private sector entities to collect and process extensive 
amounts of Pit more effectively. The number of reported security incidents 
involving Pli at federal agencies has increased dramatically in recent years. 

— — United States Government Accountability Office 
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GAO’S 2015 High Risk List 


Strengthening the Foundation for Efficiency and Effectiveness 


Limiting the Federal Government’s Fiscal Ejqoosure by Better Managing Climate Change Risks 


Management of Federal Oil and Gas Resources 

• 

Modernizing the U.S. Financial Regulatory System and the Federal Role in Housing Finance'* 


Restructuring the U.S. Postal Service to Achieve Sustainable Finandal Viability** 


Funding the Nation's Surface Transportation System** 


Strategic Human Capital Management 


Managing Federal Real Property 


improving the Management of IT Acquisitions and Operations (new) 

Transforming DOD Program Management 


DOD Approach to Business Transformation 


DOD Business Systems Modernization 


DOD Support Infrastructure Managemenf 


DOD Financial Management 


DOD Supply Chain Management 


DOD Weapon Systems Acquisition 

Ensuring Public Safety and Security 


Mitigating Gaps in Weather Satellite Data 


Strengthening Department of Homeland Security Management Functions 


Establishing Effective Mechanisms for Sharing emd Managing Terrorism-Related Infoimation to Protect the Homeland 


Ensuring the Security of Federal Information Systems and Cyber Critical infrastructure and Protecting the Privacy of Personally 
Identifiabie Information® 


Ensuring the Effective Protection of Technologies Critical to U.S. National Security Interests'* 


improving Federal Oversight of Food Safety" 


Protecting Public Health through Enhanced Oversight of Medical Products 


Transforming EPA’s Processes for Assessing and Controlling Toxic Chemicals" 

Managing Federal Contracting More Effectively 

• 

DOD Contract Management 

• 

DOE'S Contract Management for the National Nuclear Security Administration and Office of Environmental Management 

• 

NASA Acquisition Management 

Assessing the Efficiency and Effectiveness of Tax Law Administration 

• 

Enforcement of Tax Laws" 

Modernizing and Safeguarding insurance and Benefit Programs 

* 

Managing Risks and Improving VA Health Care (new) 

• 

improving and Modernizing Federal Disability Programs 


Pension Benefit Guaranty Corporation insurance Programs** 


Medicare Program" 


Medicaid Program" 


National Flood insurance Program^' 


Soiirco: GAO IGAO-15-071T 


“Legislalion is likely to be necessary to effectively address this high-risk area. 
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Chairman Johnson, Ranking Member Carper, and Members of the 
Committee: 

Thank you for the opportunity to discuss our 2015 high-risk update.^ 

Since 1990, we have regularly reported on government operations that 
we have identified as high risk due to their greater vulnerability to fraud, 
waste, abuse, and mismanagement or the need for transformation to 
address economy, efficiency, or effectiveness challenges. Our high-risk 
program, supported by this Committee and the House Committee on 
Oversight and Government Reform, has brought much-needed focus to 
problems impeding effective government and costing billions of dollars 
each year. 

Since our last high-risk update in 2013. solid, steady progress has been 
made in the vast majority of areas that remain on the list. Since 1990, 
more than one-third of the areas previously designated as high risk have 
been removed from the High Risk List because sufficient progress was 
made in addressing the problems identified. Nonetheless. 11 issues have 
been on the High Risk List since the 1990s and 6 of these were on our 
original list of 14 areas in 1990. 

Congressional oversight and legislative action have been critical to the 
progress that has been made. Congress passed numerous laws targeting 
both specific problems and the high-risk areas overall. In addition, top 
administration officials have continued to show their commitment to 
ensuring that high-risk areas receive attention and oversight. The Office 
of Management and Budget (0MB) regularly convenes meetings with 
agency leaders and GAO to discuss progress updates on high-risk 
issues. This year, due to significant progress made, we narrowed the 
high-risk designation for two areas— Protecting Public Health Through 
Enhanced Oversight of Medical Products and DOD Contract 
Management. 

We also designated two new high-risk areas this year— Managing Risks 
and Improving VA Health Care and Improving the Management of IT 
Acquisitions and Operations. Lasting solutions to these and the other 30 
high-risk areas offer the potential to save billions of dollars, dramatically 
improve service to the American public, and strengthen public confidence 


’GAO, High Risk Series: An Update, GAO-15-290 (Washington, D.C,; Feb, 11, 2015). 
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and trust in the performance and accountability of our national 
government 

While there has been notable progress, much remains to be done to 
address the 32 high-risk issues that are currently on our High Risk List. 
Our high risk update report and website provide details for each of these 
issues, describing the nature of the risks, what actions have been taken 
to address them, and what remains to be done to make further progress.^ 
The details in our report, along with successful implementation by 
agencies and continued oversight by Congress, can form a solid 
foundation for progress to address risks and improve programs and 
operations. 


New High-Risk 
Areas for 2015 


To determine which federal government programs and functions should 
be added to the High Risk List, we consider whether the program or 
function is of national significance or is key to government performance 
and accountability. Further, we consider qualitative factors, such as 
whether the risk 

• involves public health or safety, service delivery, national security, 
national defense, economic growth, or privacy or citizens’ rights, or 

• could result in significant impaired service, program failure, injury or 
loss of life, or significantly reduced economy, efficiency, or 
effectiveness. 

In addition, we also review the exposure to loss in quantitative terms such 
as the value of major assets being impaired, revenue sources not being 
realized, or major agency assets being lost, stolen, damaged, or wasted, 
We also consider corrective measures planned or under way to resolve a 
material control weakness and the status and effectiveness of these 
actions. 

This year, we added two new areas, delineated below, to the High Risk 
List based on those criteria. 


^GAO’s high risk website, httpt/AAWW.gao.gov/highrisk/. 
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Managing Risks and in response to serious and long-standing problems with veterans' access 

Improving VA Health Care which were highlighted in a series of congressional hearings in 

the spring and summer of 2014. Congress enacted the Veterans Access, 
Choice, and Accountability Act of 2014 (Pub. L. No. 113-146, 128 Slat. 
1754), which provides $15 billion in new funding for Department of 
Veterans Affairs (VA) health care. Generally, this law requires VA to offer 
veterans the option to receive hospital care and medical services from a 
non-VA provider a VA facility cannot provide an appointment within 
30 days, or when veterans reside more than 40 miles from the nearest VA 
facility. Under the law, VA received $1 0 billion to cover the expected 
increase in utilization of non-VA providers to deliver health care services 
to veterans. The $10 billion is available until expended and is meant to 
supplement VA’s current budgetary resources for medical care. Further, 
the law appropriated $5 billion to increase veterans' access to care by 
expanding VA’s capacity to deliver care to veterans by hiring additional 
clinicians and improving the physical infrastructure of VA’s facilities, it is 
therefore critical that VA ensures its resources are being used in a cost- 
effective manner to improve veterans’ timely access to health care, 

We have categorized our concerns about VA’s ability to ensure the 
timeliness, cost-effectiveness, quality, and safety of the health care the 
department provides into five broad areas; (1) ambiguous policies and 
inconsistent processes, (2) inadequate oversight and accountability, (3) 
information technology challenges, (4) inadequate training for VA staff, 
and (5) unclear resource needs and allocation priorities. We have made 
numerous recommendations that aim to address weaknesses in VA’s 
management of its health care system — more than 100 of which have yet 
to be fully resolved. For example, to ensure that its facilities are carrying 
out processes at the local level more consistently — such as scheduling 
veterans' medical appointments and collecting data on veteran suicides — 
VA needs to clarify its existing policies. VA also needs to strengthen 
oversight and accountability across its facilities by conducting more 
systematic, independent assessments of processes that are carried out at 
the local level, including how VA facilities are resolving specialty care 
consults, processing claims for non-VA care, and establishing 
performance pay goals for their providers. We also have recommended 
that VA work with the Department of Defense (DOD) to address the 
administrative burdens created by the lack of interoperability between 
their two IT systems. A number of our recommendations aim to improve 
training for staff at VA facilities, to address issues such as how staff are 
cleaning, disinfecting, and sterilizing reusable medical equipment, and to 
more clearly align training on VA’s new nurse staffing methodology with 
the needs of staff responsible for developing nurse staffing plans. Finally, 


Pages 
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we have recommended that VA improve its methods for identifying VA 
facilities’ resource needs and for analyzing the cost-effectiveness of VA 
health care. 

The recently enacted Veterans Access, Choice, and Accountability Act 
included a number of provisions intended to help VA address systemic 
weaknesses. For example, the law requires VA to contract with an 
independent entity to (1) assess VA’s capacity to meet the current and 
projected demographics and needs of veterans who use the VA health 
care system, (2) examine VA's clinical staffing levels and productivity, and 
(3) review VA’s IT strategies and business processes, among other 
things. The new law also establishes a 15-member commission, to be 
appointed primarily by bipartisan congressional leadership, which will 
examine how best to organize the VA health care system, locate health 
care resources, and deliver health care to veterans, it is critical for VA 
leaders to act on the findings of this independent contractor and 
congressional commission, as well as on those of VA’s Office of the 
inspector General, GAO, and others, and to fully commit themselves to 
developing long-term solutions that mitigate risks to the timeliness, cost- 
effectiveness, quality, and safety of the VA health care system. 

It is also critical that Congress maintains its focus on oversight of VA 
health care, in the spring and summer of 2014, congressional committees 
held more than 20 hearings to address identified weaknesses in the VA 
health care system. Sustained congressional attention to these issues will 
help ensure that VA continues to make progress in improving the delivery 
of health care services to veterans. 

We plan to continue monitoring VA’s efforts to Improve the timeliness, 
cost-effectiveness, quality, and safety of veterans’ health care. To this 
end. we have ongoing work focusing on topics such as veterans’ access 
to primary care and mental health services; primary care productivity; 
nurse recruitment and retention: monitoring and oversight of VA spending 
on training programs for health care professionals; mechanisms VA uses 
to monitor quality of care; and VA and DOD investments in Centers of 
Excellence—which are intended to produce better health outcomes for 
veterans and service members. 
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Improving the 
Management of IT 
Acquisitions and 
Operations 


Although the executive branch has undertaken numerous initiatives to 
better manage the more than $80 billion that is annually invested in 
information technology (IT), federal IT investments too frequently fail or 
incur cost overruns and schedule slippages while contributing little to 
mission-related outcomes. We have previously testified that the federal 
government has spent billions of dollars on failed IT investments. These 
and other failed IT projects often suffered from a lack of disciplined and 
effective management, such as project planning, requirements definition, 
and program oversight and governance. In many instances, agencies 
have not consistently applied best practices that are critical to 
successfully acquiring IT investments. 

We have identified nine critical factors underlying successful major 
acquisitions that support the objective of improving the management of 
large-scale IT acquisitions across the federal government: (1) program 
officials actively engaging with stakeholders; (2) program staff having the 
necessary knowledge and skills; (3) senior department and agency 
executives supporting the programs; (4) end users and stakeholders 
involved in the development of requirements; (5) end users participating 
in testing of system functionality prior to end user acceptance testing; (6) 
government and contractor staff being stable and consistent: (7) program 
staff prioritizing requirements; (8) program officials maintaining regular 
communication with the prime contractor: and (9) programs receiving 
sufficient funding,^ 

While there have been numerous executive branch initiatives aimed at 
addressing these issues, implementation has been inconsistent. Over the 
past 5 years, we have reported numerous times on shortcomings with IT 
acquisitions and operations and have made about 737 related 
recommendations. 361 of which were to the Office of Management and 
Budget (0MB) and agencies to improve the implementation of the recent 
initiatives and other government-wide, cross-cutting efforts. As of January 
2015, about 23 percent of the 737 recommendations had been fully 
implemented. 

Given the federal government's continued experience with failed and 
troubled IT projects, coupled with the fact that 0MB initiatives to help 


’GAO, Information Technology: Critical Factors Underlying Successful Major Acquisitions, 
GAO*12-7 (Washington. D.C.; Oct. 21, 2011). 
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address such problems have not been fully implemented, the government 
will likely continue to produce disappointing results and will miss 
opportunities to improve IT management, reduce costs, and improve 
services to the public, unless needed actions are taken. Further, it will be 
more difficult for stakeholders, including Congress and the public, to 
monitor agencies’ progress and hold them accountable for reducing 
duplication and achieving cost savings. 

Recognizing the severity of issues related to government-wide 
management of IT, in December 2014 the Federal information 
Technology Acquisition Reform provisions were enacted as a part of the 
Carl Levin and Howard P. ‘Buck* McKeon National Defense Authorization 
Act for Fiscal Year 2015. 1 want to acknowledge the leadership of this 
Committee and the House Committee on Oversight and Government 
Reform in leading efforts to enact this important legislation. To help 
address the management of IT investments, 0MB and federal agencies 
should expeditiously implement the requirements of the December 2014 
statutory provisions promoting IT acquisition reform.** Doing so should (1) 
improve the transparency and management of IT acquisitions and 
operations across the government, and (2) strengthen the authority of 
chief information officers to provide needed direction and oversight. To 
help ensure that these improvements are achieved, congressional 
oversight of agencies' implementation efforts is essential, 

Beyond implementing the recently enacted law, 0MB and agencies need 
to continue to implement our previous recommendations in order to 
improve their ability to effectively and efficiently invest in IT. Several of 
these are critical, such as 

• conducting TechStat reviews for at-risk investments, 

• updating the public version of the IT Dashboard throughout the year, 
and 

• developing comprehensive inventories of federal agencies’ software 
licenses. 


^Howard P. ‘Buck’ McKeon National Defense Authorization Act for Fiscal Year 2015, Pub, 
L No. 113-291. § 831(a) (Dec. 19, 2014), 
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To ensure accountability, 0MB and agencies should also demonstrate 

measurable government-wide progress in the following key areas: 

• 0MB and agencies should, within 4 years, implement at least 80 
percent of our recommendations related to the management of IT 
acquisitions and operations. 

• Agencies should ensure that a minimum of 80 percent of the 
government's major acquisitions should deliver functionality every 1 2 
months. 

• Agencies should achieve no less than 80 percent of the over $6 billion 
in planned PortfolioStat savings and 80 percent of the more than $5 
billion in savings planned for data center consolidation. 


Expanding High-Risk 
Areas 


In the 2 years since the last high-risk update, two areas have expanded in 
scope. Enforcement of Tax Laws has been expanded to include IRS's 
efforts to address tax refund fraud due to identity theft. Ensuring the 
Security of Federal Information Systems and Cyber Critical Infrastructure 
has been expanded to include the federal government's protection of 
personally identifiable information and is now called Ensuring the Security 
of Federal Information Systems and Cyber Critical Infrastructure and 
Protecting Personally Identifiable Information (PH). 


Enforcement of Tax Laws since 1990, we have designated one or more aspects of Enforcement of 
Tax Laws as high risk. The focus of the Enforcement of Tax Laws high- 
risk area is on the estimated $385 billion net tax gap— the difference 
between taxes owed and taxes paid — and IRS's and Congress's efforts to 
address it. Given current and emerging risks, we are expanding the 
Enforcement of T ax Laws area to include I RS's efforts to address tax 
refund fraud due to identity theft (IDT), which occurs when an identity thief 
files a fraudulent tax return using a legitimate taxpayer's identifying 
information and claims a refund. While acknowledging that the numbers 
are uncertain, IRS estimated paying about $5.8 billion in fraudulent IDT 
refunds while preventing $24.2 billion during the 2013 tax filing season. 

While there are no simple solutions to combating IDT refund fraud, we 
have identified various options that could help, some of which would 
require legislative action. Because some of these options represent a 
significant change to the tax system that could likely burden taxpayers 
and impose significant costs to IRS for systems changes, it is important 
for IRS to assess the relative costs and benefits of the options. This 
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assessment will help ensure an informed discussion among IRS and 
relevant stakeholders — including Congress — on the best option (or set of 
options) for preventing IDT refund fraud. 


Ensuring the Security of 
Federal Information 
Systems and Cyber 
Critical Infrastructure and 
Protecting the Privacy of 
Personally Identifiable 
Information 


Since 1997, we have designated the security of our federal cyber assets 
as a high-risk area. In 2003, we expanded this high-risk area to include 
the protection of critical cyber infrastructure. 

The White House and federal agencies have taken steps toward 
improving the protection of our cyber assets. However, advances in 
technology which have dramatically enhanced the ability of both 
government and private sector entities to collect and process extensive 
amounts of Personally Identifiable Information (Pil) pose challenges to 
ensuring the privacy of such information. The number of reported security 
incidents involving Pit at federal agencies has increased dramatically in 
recent years, in addition, high-profile Pil breaches at commerciai entities 
have heightened concerns that personal privacy is not being adequately 
protected. Finally, both federal agencies and private companies collect 
detailed Information about the activities of individuals-raising concerns 
about the potential for significant erosion of personal privacy. We have 
suggested, among other things, that Congress consider amending privacy 
laws to cover al! Pli collected, used, and maintained by the federal 
government and recommended that the federal agencies we reviewed 
take steps to protect personal privacy and improve their responses to 
breaches of PM. For these reasons, we added the protection of privacy to 
this high-risk area this year. 


Essential Elements 
for Addressing High- 
Risk Areas 


Our experience with the high-risk series over the past 25 years has 
shown that five broad elements are essential to make progress.® The five 
criteria for removal are as follows; 

* Leadership commitment. Demonstrated strong commitment and top 
leadership support. 

• Capacity. Agency has the capacity (i.e.. people and resources) to 
resolve the risk(s). 


®GAO, Determining Performance and Accountability Challenges and High Risks, 
GAO-01'159SP (Washington, D,C.; November 2000). 
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• Action plan. A corrective action pian exists that defines the root 
cause and solutions and that provides for substantially completing 
corrective measures, including steps necessary to implement 
solutions we recommended. 

• Monitoring. A program has been instituted to monitor and 
independently validate the effectiveness and sustainability of 
corrective measures. 

• Demonstrated progress. Ability to demonstrate progress in 
implementing corrective measures and in resolving the high-risk area. 

These five criteria form a road map for efforts to improve and ultimately 
address high-risk issues. Addressing some of the criteria leads to 
progress, while satisfying ail of the criteria is centra! to removal from the 
list. Figure 1 shows the five criteria and examples of actions taken by 
agencies to address the criteria. Throughout my statement and in our 
high-risk update report, we have detailed many actions taken to address 
the high-risk areas aligned with the five criteria as well as additional steps 
that need to be addressed. 
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Monitoring 


Demonstrated 
Pf ogress 


Leadership 

Commitment 


Action Plan 


Capacity 


High Risk Criteria Examples 


I Root Causes & 
.Corrective Measures < 


Top Leadership 
Support 


Substantiate 

Effectiveness 


Holding frequent review 
meetings to assess 
status and performance 

Reporting to senior 
managers on program 
progress and potential 
risks 

Tracking progress 
against goals 


Establishing long-term 
priorities and goats 
Developing 

organizational changes 
and initiatives 
Providing continuing 
oversight and 
accountability 
Initiating or implementing 
legislation 


Allocating or reallocating 
funds or staff 
Establishing work 
groups with specific 
responsibilities 
Establishing and 
maintaining procedures 
or systems 


Identifying and analyzing 
root causes of problems 
Identifying CTitical actions 
and outcomes to address 
root causes 
Developing milestones 
and metrics for 
implementing plan goals 
Ensuring there are 
processes for reporting 
progress 

Establishing goals and 
performance measures 


Taking actions to 
ensure progress (or 
improvements) are 
sustained 

Using data to show 
action on plan 
implementation 

Showing high-risk 
issues are being 
effectively managed 
and root causes are 
being addressed 


Souren: GAO onniysia of Bflfsncia*' actions to address higfvrisif issiwa and GAOcrileftaforfeincrval from the High Risk Lfsl ki GAO-01-159SP ! GAO-I5-37IT 


in each of our high-risk updates, for more than a decade, we have 
assessed progress to address the five criteria for removing the high-risk 
areas from the list. In this high-risk update, we are adding additional 
clarity and specificity to our assessments by rating each high-risk area’s 
progress on the criteria, using the following definitions; 


• Met. Actions have been taken that meet the criterion. There are no 
significant actions that need to be taken to further address this 
criterion. 

• Partially met Some, but not all, actions necessary to meet the 
criterion have been taken. 
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• Not met. Few, if any, actions towards meeting the criterion have been 
taken. 

Figure 2 is a visual representation of varying degrees of progress in each 
of the five criteria for a high-risk area. Each point of the star represents 
orre of the five criteria for removal from the High Risk List and each ring 
represents one of the three designations: not met, partially met, or met. 


Figure 2: High-Risk Progress Criteria Ratings 



Source; GAO, 1 GAOASSTIT 


The progress ratings used to address the high-risk criteria are an 
important part of our efforts to provide greater transparency and 
specificity to agency leaders as they seek to address high-risk areas. 
Beginning in the spring of 2014 leading up to this high-risk update, we 
met with agency leaders across government to discuss preliminary 
progress ratings. These meetings focused on actions taken and on 
additional actions that need to be taken to address the high-risk issues. 
Several agency leaders told us that the additional clarity provided by the 
progress rating helped them better target their improvement efforts. 


ContinU©d Proar6SS since our last high-risk update in 2013, there has been solid and steady 
® progress on the vast majority of the 30 high-risk areas from our 201 3 list. 

Progress has been possible through the concerted actions and efforts of 
Congress and the leadership and staff in agencies and 0MB, As shown in 
table 1,18 high-risk areas have met or partially met all criteria for removal 
from the list; 1 1 of these areas also fully met at least one criterion. Of the 
1 1 areas that have been on the High Risk List since the 1 990s, 7 have at 
least met or partially met ail of the criteria for removal and 1 area — DOO 
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Contract Management— \s 1 of the 2 areas that has made enough 
progress to remove subcategories of the high-risk area. Overall, 28 high- 
risk areas were rated against the five criteria, totaling a possible 140 high- 
risk area criteria ratings. Of these, 122 (or 87 percent) were rated as met 
or partially met. On the other hand, 13 of the areas have not met any of 
the five criteria; 3 of those — DOD Business Systems Modernization, DOD 
Support Infrastructure Management, and DOD Financial Management — 
have been on the High Risk List since the 1990's. 


Table 1: High-Risk Areas Rated Against Five Criteria for Removal 

Number of criteria 

High-risk area 

Met 

Partially 

met 

Not met 

NASA Acquisition Management® 

3 

2 

0 

Establishing Effective Mechanisms for Sharing and Managing Terrorism-Related 

Infomnation to Protect the Homeland 

2 

3 

0 

Protecting Public Health through Enhanced Oversight of Medical Products 

2 

3 

0 

Strengthening Department of Homeland Security Management Functions 

2 

3 

0 

DOD Contract Management® 

1 

4 

0 

DOD Supply Chain Management® 

1 

4 

0 

DOD Weapon Systems Acquisition® 

1 

4 

0 

Management of Federal Oil and Gas Resources 

1 

A 

0 

Medicare Program® 

1 

A 

0 

Mitigating Gaps in Weather Satellite Data 

1 

4 

0 

Ensuring the Security of Federal Information Systems and Cyber Critical Infrastructure and 
Protecting the Privacy of Personally Identifiable Information® 

1 

A 

0 

DOD Support Infrastructure Management® 

0 

5 

0 

Ensuring the Effective Protection of Technologies Critical to U.S, National Security 

Interests 

0 

5 

0 

improving and Modernizing Federal Disability Programs 

0 

5 

0 

Medicaid Program 

0 

5 

0 

Modernizing the U.S, Financial Regulatory System and Federal Role m Housing Finance 

0 

5 

0 

National Flood Insurance Program 

0 

5 

0 

Restructuring the U.S. Postal Service to Achieve Sustainable Financial Viability 

0 

5 

0 

Enforcement of Tax Laws® 

1 

3 

1 

Managing Federal Real Property 

1 

3 

1 

DOD Business Systems Modernization® 

0 

4 

1 

Strategic Human Capital Management 

0 

4 

1 

Transforming EPA’s Processes for Assessing and Controlling Towc Chemicals 

1 

2 

2 


Page 12 


GAO-15-371T 



58 


Number of criteria 

High-risk area 

Met 

Partially 

met 

Not met 

DOD Financial Management® 

0 

3 

2 

Limiting the Federal Government's Fiscal Exposure by Better Managing Climate Change 

Risks 

0 

3 

2 

Improving Federal Oversight of Food Safety 

0 

3 

2 

DOE'S Contract Management for the National Nuclear Security Administration and Office of 
Environmental Management® 

1 

1 

3 

DOD Approach to Business Transformation 

0 

2 

3 

Funding the Nation's Surface Transportation System 

N/A 

N/A 

N/A 

Improving the Management of IT Acquisitions and Operations 

N/A 

N/A 

N/A 

Managing Risks and Improving VA Health Care 

N/A 

N/A 

N/A 

Pension Benefit Guaranty Corporation Insurance Programs 

N/A 

N/A 

N/A 


Uegend: N/A* Not applicable, 

Souree; OAO. I GAO-15-371T 


Note: Four high-risk areas that received a "not applicable" rating because (1) they are either new to 
our 2015 High-Risk List {Managing Risks and Improving VA Health Care and improving the 
Management of IT Acquisitions and Operations) or (2) addressing the high risk area primarily involves 
congressional action and the high risk criteria and subsequent ratings were developed to reflect the 
status of agencies’ actions and the additional steps they need to take {Funding the Nation's Surface 
Transportation System and Pension Benefit Guaranty Corporation Insurance Prog/ams). 

®= issue has been on the high risk list since the 1990s, 

Throughout the history of the high-risk program, Congress played an 
important role through its oversight and {where appropriate) through 
legislative action targeting both specific problems and the high-risk areas 
overall. Since our last high-risk report, several high-risk areas have 
received congressional oversight and legislation needed to make 
progress in addressing risks. Table 2 provides examples of congressional 
actions and of high-level administration initiatives — discussed in more 
detail throughout our report — that have led to progress in addressing 
high-risk areas. Additional congressional actions and administrative 
Initiatives are also included in the individual high-risk areas discussed in 
this report. 
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Tabfs 2; Selected Examples of Congressional Actions and Administration initiatives Leading to Progress on High-Risk Areas 

High-risk area 

Selected example 

Mitigating Gaps in 
Weather Satellite Data 

In January 2013. Congress passed ttie Disaster Relief Appropriations Act, 2013, which contained $111 
million in funding for satellite gap mitigation projects. According to National Oceanic and Atmospheric 
Administration officials, this amount was reduced by 5 percent due to budget cuts related to sequestration. 

Protecting Public Health 
through Enhanced 
Oversight of Medical 
Products 

Congress enacted the Drug Quality and Security Act in November 201 3, which contains provisions that 
should help the Food and Drug Administration respond to challenges in two distinct areas that we reported 
on in July 2013: (1) the hazards posed by unsafe drugs from an increasingly complex pharmaceutical 
supply chain that includes rogue Internet pharmacies and (2) the public health threat posed by improperly 
compounded drugs. 

Pension Benefit 
Guaranty Corporation 
(PBGC) Insurance 
Programs 

in December 2014, Congress took action to address the growing crisis in the multiemployer pension system 
with passage of the Multiemployer Pension Refonn Act of 2014, which enacted several reforms 
responsive to our 2013 report on PBGC's multiemptoyer program. The act provided severely underfunded 
plans, under certain conditions and with tiie approval of federal regulators, the option to reduce the 
retirement benefits of current retirees to avoid plan insolvency and expand PBGC’s ability to intervene when 
plans are in finandal distress. While these reforms are intended to improve the program’s financial 
condition, the ftjture insolvency of the multiempioyer program remains likely. In addition, to help address 
PBGC's overall deficit, the Bipartisan Budget Act of 2013 increased premium rates for the single-employer 
program and the Multiemployer Pension Reform Act increased premiums for the multiempioyer program. 

Ensuring the Security of 
Federal Information 
Systems and Cyber 
Critical infrastructure 
and Protecting the 
Privacy of Personally 
Identifiable information 

In December 2014, five cybersecurity-reiated bills were enacted into law, (1) The Federal Information 
Security Modernization Act of 2014 revised the Federal information Security Management Act of 2002, 
Among other things, it gave the Department of Homeland Security (DHS) responsibilities to assist the Office 
of Management and Budget (OMB) in overseeing civilian agency information security policies and practices 
for Information systems. In addition, it requires agencies to include automated tools in periodic testing of 
systems and expands requirements for reporting major incidents and data breach notifications. (2) The 
Cybersecurity Workforce Assessment Act requires DHS to assess its cybersecurity workforce and 
develop a comprehensive strategy to enhance the readiness, capacity, training, recruitment, and retention 
of its cybersecurity woii<force. (3) The Homeland Security Cybersecurity Workforce Assessment Act 
requires DHS to identify cybersecuhty positions and the specialty areas of critical need in the DHS 
cybersecurity workforce. (4) The National Cybersecurity Protection Act of 2014 codifies the role of DHS’s 
National Cybersecurity and Communications integration Center, a 24x7 cyber situational awareness, 
incident response and management center (hat is a national nexus of cyber and communications integration 
for the federal government, intelligence community, and law enforcement, (5) The Cybersecurity 
Enhancement Act of 2014 authorizes the Department of Commerce, through the National Institute of 
Standards and Technology, to facilitate and support the development of voluntary standards to reduce cyber 
risks to critical infrastaicture. The law also requires the Office of Science and Technology Policy in the 
Executive Office of the President to facilitate agencies’ development of a federal cybersecurity research and 
development plan. 

DOD Approach to 
Business 

Transformation 

The Car! Levin and Howard P. ‘Buck’ McKeon Natlonai Defense Authorization Act for Fiscal Year 

201 5 converted the Deputy Chief Management Officer to the Under Secretary of Defense for Business 
Management and Information. The Under Secretary of Defense for Business Management and Information 
will assist the Deputy Secretary of Defense in his role as the Chief Management Officer, The Under 

Secretary of Defense for Business Management and information will also serve as the Chief Information 
Officer and Performance Improvement Officer for the Department of Defense. These changes will take 
effect on February 1, 2017, 
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High-risk area 

Selected example 

DOD Financial 
Management 

The National Defense Authorization Act (NDAA) for Fiscal Year 2013 required the Financial 

Improvement and Audit Readiness Plan to state the actions taken to ensure validation of the audit readiness 
of the Department of Defense (DOD) Statement of Budgetary Resources no later than September 30, 2014. 
Although the November 2014, Financial improvement and Audit Readiness Plan Status Report 
acknowledges that DOD has not met ttiat date. Congress' acton to set a specific date for the goal of DOD 
audit readiness is important for holding DOD acxrountable for progress. Congress further strengthened 
accountability in the NDAA for Fiscal Year 2014 by r«?uiring a full audit of DOD’s fiscal year 2018 financial 
statements and for those results to be submitted to Congress no later than March 31 , 201 9. 

Strengthening 
Department of 

Homeiand Security 
Management Functions 

The Department of Homeland Security (DHS) has established various initiatives collectively intended to 
improve its unity of effort by, among other things, improving the department’s pianning, programming, 
budgeting, and execution processes through strengthened departoental structures and increased 
capability. In addition, DHS has increased component-level acquisition capability by, among other things, 
initiating monthly Component Acquisition Executive staff forums to provide guidance and share best 
practices. DHS has also strengthened its enterprise ardiitecture program (or blueprint) to guide and 
constrain information technology acquisitions and has obtained a clean opinion on its financial statements 
for 2 consecutive years, fiscal years 2013 and 2014. 

Improving and 
Modernizing Federal 
Disability Programs 

The administration has set goals for hiring people with disabilities and launched a training course in July 

2014 to help federal agencies hire, retain, and advance employees with disabilities. The administration 
continues to track— and has made some progress increasing— employment for people with disabilities at 
federal agencies. 

Source: GAO. | GAO-15-3V1T 


Narrowing High since our 2013 update, sufficient progress has been made to narrow the 

Risk Arsas scope of the following two areas. 


Protecting Public Health 
through Enhanced Oversight 
of Medical Products 


Protecting Public Health through 
Enhanced Oversight of Medical 
Products 



TWO C!'^!TE;R!A HAVE KEN .yrt 


Our work has identified the following high-risk issues related to the Food 
and Drug Administration's (FDA) efforts to oversee medical products: (1) 
oversight of medical device recalls, (2) implementation of the Safe 
Medical Devices Act of 1990, (3) the effects of globalization on medical 
product safety, and (4) shortages of medically necessary drugs. We 
added the oversight of medical products to our High Risk List In 2009. 
Since our 2013 high-risk update, FDA has made substantial progress 
addressing the first two areas; therefore, we have narrowed this area to 
remove these issues from our High Risk List. However, the second two 
issues, globalization and drug shortages, remain pressing concerns. 

FDA has greatly improved its oversight of medical device recalls by fully 
implementing all of the recommendations made in our 2011 report on this 
topic. Recalls provide an important tool to mitigate serious health 
consequences associated with defective or unsafe medical devices. We 
found that FDA had not routinely analyzed recall data to determine 
whether there are systemic problems underlying trends in device recalls. 
We made specific recommendations to the agency that it enhance its 
oversight of recalls, FDA is fully implementing our recommendations and 
has developed a detailed action plan to improve the recall process, 
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analyzed 10 years of medical device recall trend data, and established 
explicit criteria and set thresholds for determining whether recalling firms 
have performed effective corrections or removals of defective products. 
These actions have addressed this high-risk issue. 


The Safe Medical Devices Act of 1990 requires FDA to determine the 
appropriate process for reviewing certain high-risk devices — either 
reclassifying certain high-risk medical device types to a iower-risk class or 
establishing a schedule for such devices to be reviewed through its most 
stringent premarket approval process. We found that FDA’s progress was 
slow and that it had never established a timetable for its reclassification or 
re-review process. As a result, many high-risk devices — including device 
types that FDA has identified as implantable, life sustaining, or posing a 
significant risk to the health, safety, or welfare of a patient — still entered 
the market through FDA's less stringent premarket review process. We 
recommended that FDA expedite its implementation of the act. Since 
then. FDA has made good progress and began posting the status of its 
reviews on its website. FDA has developed an action plan with a goal of 
fully implementing the provisions of the act by the second quarter of 
calendar year 2015. While FDA has more work to do, it has made 
sufficient progress to address this high-risk issue. 


DOD Contract Management 


DOO Contract Management 





ONE CRITERION HAS SEEN MET, 

GAO 1 JOfS I'Aah Risk Lfcjl OAO-'lS-STtT 


Based on our reviews of DOD’s contract management activities over 
many years, we placed this area on our High Risk List in 1992. For the 
past decade, our work and that of others has identified challenges DOD 
faces within four segments of contract management; ( 1 ) the acquisition 
workforce, (2) contracting techniques and approaches, (3) service 
acquisitions, and (4) operational contract support, DOD has made 
sufficient progress in one of the four segments — its management and 
oversight of contracting techniques and approaches — to warrant its 
removal as a separate segment within the overall DOD contract 
management high-risk area. Significant challenges still remain in the 
other three segments. 

We made numerous recommendations to address the specific issues we 
identified. DOD leadership has generally taken actions to address our 
recommendations. For example, DOD promulgated regulations to better 
manage its use of time-and-materials contracts and undefinitized contract 
actions (which authorize contractors to begin work before reaching a final 
agreement on contract terms). In addition, 0MB directed agencies to take 
action to reduce the use of noncompetitive and time-and-materia!s 
contracts. Similarly, Congress has enacted legislation to limit the length of 
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noncompetitive contracts and require DOD to issue guidance to link 
award fees to acquisition outcomes. 

Over the past several years, DOD’s top leadership has taken significant 
steps to plan and monitor progress in the management and oversight of 
contracting techniques and approaches. For example, through its Better 
Buying Power initiatives DOD leadership identified a number of actions to 
promote effective competition and to better utilize specific contracting 
techniques and approaches. In that regard, in 2010 DOD issued a policy 
containing new requirements for competed contracts that received only 
one offer — a situation 0MB has noted deprives agencies of the ability to 
consider alternative solutions in a reasoned and structured manner and 
which DOD has termed Ineffective competition.” These changes were 
codified in DOD’s acquisition regulations in 2012. In May 2014, we 
concluded that DOD’s regulations help decrease some of the risks of one 
offer awards, but also that DOD needed to take additional steps to 
continue to enhance competition, such as establishing guidance for when 
contracting officers should assess and document the reasons only one 
offer was received, DOD concurred with the two recommendations we 
made In our report and has since implemented one of them. 

DOD also has been using its Business Senior Integration Group (BSIG)— 
an executive-level leadership forum— for providing oversight in the 
planning, execution, and implementation of these initiatives. In March 
2014, the Director of the Office of Defense Procurement and Acquisition 
Policy presented an assessment of DOD competition trends that provided 
information on competition rates across DOD and for selected commands 
within each military department and proposed specific actions to improve 
competition. The BSIG forum provides a mechanism by which DOD can 
address ongoing and emerging weaknesses in contracting techniques 
and approaches and by which DOD can monitor the effectiveness of its 
efforts. Further, in June 2014, DOD issued its second annual assessment 
of the performance of the defense acquisition system. The assessment, 
included data on the system’s competition rate and goals, assessments of 
the effect of contract type on cost and schedule control, and the impact of 
competition on the cost of major weapon systems. 

An institution as large, complex, and diverse as DOD. and one that 
obligates hundreds of billions of dollars under contracts each year, will 
continue to face challenges with its contracting techniques and 
approaches. We will maintain our focus on identifying these challenges 
and proposing solutions. However, at this point DOD's continued 
commitment and demonstrated progress in this area — including the 
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establishment of a framework by which DOD can address ongoing and 
emerging issues associated with the appropriate use of contracting 
techniques and approaches — provide a sufficient basis to remove this 
segment from the DOD contract management high-risk area. 


Progress in Seiected in addition to the two areas that we narrowed — Pmtecting Public Health 

High-Risk Areas through Enhanced Oversight of Medical Products and DOD Contract 

Management — nine other areas met at least one of the criteria for 
removal from the High Risk List and were rated at least partially met for 
ail four of the remaining criteria. These areas serve as examples of solid 
progress made to address high-risk issues through implementation of our 
recommendations and through targeted corrective actions. Further, each 
example underscores the importance of high-level attention given to high- 
risk areas within the context of our criteria by the administration and by 
congressional action. To sustain progress in these areas and to make 
progress in other high-risk areas— including eventual removal from the 
High Risk List — focused leadership attention and ongoing oversight will 
be needed. 


NASA Acquisition 
Management 



THREE CRITERIA HAVS: EEEN MEI. 


The National Aeronautics and Space Administration’s (NASA) acquisition 
management was included on the original High Risk List in 1990. NASA's 
continued efforts to strengthen and integrate its acquisition management 
functions have resulted in the agency meeting three criteria for removal 
from our High Risk List-leadership commitment, a corrective action plan, 
and monitoring. For example, NASA has completed the implementation of 
its corrective action plan, which was managed by the Deputy 
Administrator, with the Chief Engineer, the Chief Financial Officer, and 
the agency’s Associate Administrator having led implementation of the 
individual initiatives.® The plan identified metrics to assess the progress of 
implementation, which NASA continues to track and report semi-annually. 
These metrics include cost and schedule performance indicators for 
NASA’s major development projects. We have found that NASA’s 
performance metrics generally reflect improved performance. For 
example, average cost and schedule growth for NASA's major projects 
has declined since 201 1 and most of NASA’s major projects are tracking 
metrics, which we recommended in 201 1 to better assess design stability 


Soui'cs; GA(D i 2015 Risk t.jsl GAD-Tli-STiT 


^NASA’s Associate Administrator oversees the agency's Office of Evaluation, which 
includes divisions responsible for cost analysis and independent program evaluation, 
respectively. 
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and decrease risk. In addition, NASA has taken action in response to our 
recommendations to improve the use of earned value management— a 
tool designed to help project managers monitor progress — such as by 
conducting a gap analysis to determine whether each center has the 
requisite skills to effectively utilize earned value management. 

These actions have helped NASA to create better baseline estimates and 
track performance so that NASA has been able to launch more projects 
on time and vsrithin cost estimates. However, we found that NASA needs 
to continue its efforts to Increase agency capacity to address ongoing 
issues through additional guidance and training of personnel. Such efforts 
should help maximize improvements and demonstrate that the improved 
cost and schedule performance wll be sustained, even for the agency's 
most expensive and complex projects. 

Recently, a few of NASA's major projects are rebaselining their cost, 
schedule, or both in light of management and technical issues, which is 
tempering the progress of the whoie portfolio, in addition, several of 
NASA’s largest and most complex projects, such as NASA’s human 
spaceflight projects, are at critical points in implementation. We have 
reported on several challenges that may further impact NASA’s ability to 
demonstrate progress in improving acquisition management^. 


^ See James Webb Space Telescope: Project Facing Increased Schedule Risk with 
Significant Work Remaining. GAO-15-100, Washington, D.C,: December 15, 2014; NASA: 
Actions Needed to Improve Transparency and Assess Long-Term Affordability of Human 
Exploration Programs. GAO-14-385, Washington, O.C.; May 8, 2014; and NASA: 
Assessments of Selected Large-Scale Projects. GAO-14-338SP. Washington, D C: April 
15, 2014. 
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Establishing Effective 
Mechanisms for Sharing and 
Managing Terrorism-Related 
Information to Protect the 
Homeland 


Establishing Effective 
Mechanisms for Sharing and 
Managing Terrorism-Related 
Information to Protect the - 
Homeland 



'WO CRITERIA HAVE BEEN MET. 

Sooros: GAO annlysi.s. | JOl'.l High Risk list 


The federal government has made significant progress in promoting the 
sharing of information on terrorist threats since we added this issue to the 
High Risk List in 2003. As a result, the federal government has met our 
criteria for leadership commitment and capacity and has partially met the 
remaining criteria for this high-risk area. Significant progress was made in 
this area by developing a more structured approach to achieving the 
Information Sharing Environment (Environment) and by defining the 
highest priority initiatives to accomplish. In December 2012, the President 
released the National Strategy for Information Sharing and Safeguarding 
(Strategy), which provides guidance on the implementation of policies, 
standards, and technologies that promote secure and responsible 
national security information sharing. In 2013, in response to the Strategy, 
the Program Manager for the Environment released the Strategic 
Implementation Plan for the National Strategy for information Sharing and 
Safeguarding (Implementation Plan). 

The Implementation Plan provides a roadmap for the implementation of 
the priority objectives In the Strategy. The Implementation Plan also 
assigns stewards to coordinate each priority objective — in most cases, a 
senior department official— and provides time frames and milestones for 
achieving the outcomes in each objective. Adding to this progress is the 
work the Environment has done to address our previous 
recommendations. In our 201 1 report on the Environment, we 
recommended that key departments better define incremental costs for 
information sharing activities and establish an enterprise architecture 
management plan. Since then, senior officials in each key department 
reported that any incremental costs related to implementing the 
Environment are now embedded within each department’s mission 
activities and operations and do not require separate funding. Further, the 
2013 Implementation Plan includes actions for developing aspects of an 
architecture for the Environment. In 2014, the program manager issued 
the Information Interoperability Framework, which begins to describe key 
elements intended to help link systems across departments to enable 
information sharing. 


Going forward, in addition to maintaining leadership commitment and 
capacity, the program manager and key departments will need to 
continue working to address remaining action items informed by our five 
high-risk criteria, thereby helping to reduce risks and enhance the sharing 
and management of terrorism-related information. 
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Homeland Security 
Management Functions 


Strengthening Department of 
Homeland Security Management 
Functions 



TWO CRfTiTRiA HAVE BEEN MET, 
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The Department of Homeland Security (DHS) has continued efforts to 
strengthen and integrate its management functions since those issues 
were placed on the High Risk List in 2003. These efforts resulted in the 
department meeting two criteria for removal from the High Risk List 
(leadership commitment and a corrective action plan) and partially 
meeting the remaining three criteria (capacity, a framework to monitor 
progress, and demonstrated, sustained progress). DHS’s top leadership, 
including the Secretary and Deputy Secretary of Homeland Security, have 
continued to demonstrate exemplary commitment and support for 
addressing the department's management challenges. For instance, the 
Department's Under Secretary for Management and other senior 
management officials have routinely met with us to discuss the 
department's plans and progress, which helps ensure a common 
understanding of the remaining work needed to address our high-risk 
designation. 

In April 2014, the Secretary of Homeland Security issued Strengthening 
Departmental Unity of Effort, a memorandum committing the agency to, 
among other things, improving DHS’s planning, programming, budgeting, 
and execution processes through strengthened departmental structures 
and increased capability. In addition, DHS has continued to provide 
updates to the report Integrated Strategy for High Risk Management, 
demonstrating a continued focus on addressing its high-risk designation. 
The integrated strategy includes key management initiatives and related 
corrective action plans for achieving 30 actions and outcomes, which we 
identified and DHS agreed are critical to addressing the challenges within 
the department's management areas and to integrating those functions 
across the department. Further, DHS has demonstrated progress to fully 
address nine of these actions and outcomes, five of which it has 
sustained as fully implemented for at least 2 years. For example, DHS 
fully addressed two outcomes because it received a clean audit opinion 
on its financial statements for 2 consecutive fiscal years, 2013 and 2014. 
In addition, the department strengthened its enterprise architecture 
program (or technology blueprint) to guide IT acquisitions by, among 
other things, largely addressing our prior recommendations aimed at 
adding needed architectural depth and breadth. 

DHS needs to continue implementing its Integrated Strategy for High Risk 
Management and show measurable, sustainable progress in 
implementing its key management initiatives and corrective actions and 
achieving outcomes. In doing so, it will be important for DHS to identify 
and work to mitigate any resource gaps, and prioritize initiatives as 
needed to ensure it can implement and sustain its corrective actions, 



DOD Supply Chain 
Management 


DOD Supply Chain Management 



ONH CRlTERiOrj HAS BSEN MSI 
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closely track and independently validate the effectiveness and 
sustainability of its corrective actions and make midcourse adjustments 
as needed; and make continued progress in achieving the 21 actions and 
outcomes it has not fully addressed, and demonstrate that systems, 
personnel, and policies are in place to ensure that progress can be 
sustained over time. 

DOD supply chain management is one of the six issues that has been on 
the High Risk List since 1990. DOD has made progress in addressing 
weaknesses in all three dimensions of its supply chain management 
areas: inventory management, materiel distribution, and asset visibility. 
With respect to inventory management, DOD has demonstrated 
considerable progress in implementing its statutorily mandated corrective 
action plan. This plan is intended to reduce excess inventory and improve 
inventory management practices. Additionally, DOD has established a 
performance management framework, including metrics and milestones, 
to track the implementation and effectiveness of its corrective action plan 
and has demonstrated considerable progress In reducing its excess 
inventory and improving its Inventory management. For example, DOD 
reported that its percentage of on-order excess inventory dropped from 
9,5 percent in fiscal year 2009 to 7.9 percent in fiscal year 2013. DOD 
calculates the percentage by dividing the amount of on-order excess 
inventory by the total amount of on-order inventory, in response to our 

2012 recommendations on the implementation of the plan, DOD 
continues to re-examine its goals for reducing excess inventory, has 
revised its goal for reducing on-hand excess inventory (it achieved Its 
original goal early), and is in the process of institutionalizing its inventory 
management metrics in policy. 

DOD has also made progress in addressing its materiel distribution 
challenges. Specifically, DOD has implemented, or is implementing, 
distribution-related initiatives that could serve as a basis for a corrective 
action plan. For example, DOD developed its Defense Logistics Agency 
Distribution Effectiveness initiative, formerly called Strategic Network 
Optimization, to improve logistics efficiencies in DOD’s distribution 
network and to reduce transportation costs. This initiative accomplishes 
these objectives by storing materiel at strategically located Defense 
Logistics Agency supply sites. 

Further, DOD has demonstrated significant progress in addressing its 
asset visibility weaknesses by taking steps to implement our February 

2013 recommendation that DOD develop a strategy and execution plans 
that contain all the elements of a comprehensive strategic plan, including, 
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among other elements, performance measures for gauging results. The 
National Defense Authorization Act for Fisca! Year 2014 required that 
DOD’s strategy and implementation plans for asset visibility, which were 
in development, incorporate, among other things, the missing elements 
that we identified. DOD’s January 2014 Strategy for Improving DOD 
Asset Visibility represents a corrective action plan and contains goals and 
objectives — as well as supporting execution plans — outlining specific 
objectives intended to improve asset visibility. DOD’s Strategy calls for 
organizations to Identify at least one outcome or key performance 
indicator for assessing performance in implementing the initiatives 
intended to improve asset visibility. DOD has also established a structure, 
including its Asset Visibility Working Group, for monitoring implementation 
of its asset visibility improvement initiatives. 

Moving forward, the removal of DOD supply chain management from 
GAO’S High Risk List will require DOD to take several steps. For 
Inventory management, DOD needs to demonstrate sustained progress 
by continuing to reduce its on-order and on-hand excess inventory, 
developing corrective actions to improve demand forecast accuracy, and 
implementing methodologies to set inventory levels for reparable items 
(i.e., items that can be repaired) with low or highly variable demand. For 
materiel distribution, DOD needs to develop a corrective action plan that 
includes reliable metrics for. among other things, identifying gaps and 
measuring distribution performance across the entire distribution pipeline, 
For asset visibility. DOD needs to (1) specify the linkage between the 
goals and objectives in its Strategy and the initiatives intended to 
implement it and (2) refine, as appropriate, its metrics to ensure they 
assess progress towards achievement of those goals and objectives. 
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DOD weapon systems acquisition has a!so been on the High-Risk List 
since 1990. Congress and DOD have long sought to improve the 
acquisition of major \ft^apon systems, yet many DOD programs are stiil 
falling short of cost, schedule, and performance expectations. The results 
are unanticipated cost overruns, reduced buying power, and in some 
cases delays or reductions in the capability ultimately delivered to the 
warfighter. 

Our past work and prior high-risk updates have identified multiple 
weaknesses in the way DOD acquires the weapon systems it delivers to 
the warfighter and we have made numerous recommendations on how to 
address these weaknesses. Recent actions taken by top leadership at 
DOD indicate a firm commitment to improving the acquisition of weapon 
systems as demonstrated by the release and implementation of the 
Under Secretary of Defense for Acquisition. Technology, and Logistics’ 
“Better Buying Power" initiatives. These initiatives include measures such 
as setting and enforcing affordability constraints, instituting a long-term 
investment plan for portfolios of weapon systems, implementing “should 
cost” management to control contract costs, eliminating redundancies 
within portfolios, and emphasizing the need to adequately grow and train 
the acquisition workforce. 


DOD also has made progress in its efforts to assess the root causes of 
poor weapon system acquisition outcomes and in monitoring the 
effectiveness of its actions to improve its management of weapon 
systems acquisition. Through changes to acquisition policies and 
procedures, DOD has made demonstrable progress and, if these reforms 
are fully implemented, acquisition outcomes should improve. At this point, 
there is a need to build on existing reforms by tackling the incentives that 
drive the process and behaviors. In addition, further progress must be 
made In applying best practices to the acquisition process, attracting and 
empowering acquisition personnel, reinforcing desirable principles at the 
beginning of the program, and improving the budget process to allow 
better alignment of programs and their risks and needs. While DOD has 
made real progress on the issues we have identified in this area, with the 
prospect of slowly growing or flat defense budgets for years to come, the 
department must continue this progress and get better returns on its 
weapon system investments than it has in the past, 

DOD has made some progress in updating its policies to enable better 
weapon systems outcomes. However, even with this call for change we 
remain concerned about the full implementation of proposed reforms as 
DOD has, in the past, failed to convert policy into practice. In addition, 
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although we reported in March 2014 on the progress many DOD 
programs are making in reducing their cost in the near term, individual 
weapon programs are stiii failing to conform to best practices for 
acquisition or to implement key acquisition reforms and initiatives that 
could prevent long-term cost and schedule growth.® 
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We added this high-risk area in 1997 and expanded it this year to include 
protection of Pli. Although significant challenges remain, the federal 
government has made progress toward improving the security of its cyber 
assets. For example. Congress, as part of its ongoing oversight, passed 
five bills, which became law, for improving the security of cyber assets. 
The first. The Federal Information Security Modernization Act of 2014,® 
revises the Federal Information Security Management Act of 2002^° and 
clarifies roles and responsibilities for overseeing and implementing 
federal agencies’ information security programs. The second law, the 
Cybersecurity Workforce Assessment Act,’^ requires DHS to assess its 
cybersecurity workforce and develop a strategy for addressing workforce 
gaps. The third, the Homeland Security Cybersecurity Workforce 
Assessment Act.''^ requires DHS to identify all of its cybersecurity 
positions and calls for the department to identify specialty areas of critical 
need in its cybersecurity workforce. The fourth, the National 
Cybersecurity Protection Act of 2014,^® codifies the role of DHS' National 
Cybersecurity and Communications Integration Center as the nexus of 
cyber and communications integration for the federal government, 
intelligence community, and law enforcement. The fifth, the Cybersecurity 
Enhancement Act of 2014, authorizes the Department of Commerce, 
through the National Institute of Standards and Technology, to facilitate 
and support the development of voluntary standards to reduce cyber risks 
to critical infrastructure. 
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Page 25 


GAO-1 5-371 T 



71 


The White House and senior leaders at DHS have also committed to 
securing critical cyber assets. Specifically, the President has signed 
legislation and issued strategy documents for improving aspects of 
cybersecurity, as well as an executive order and a policy directive for 
improving the security and resilience of critical cyber infrastructure, in 
addition, DHS and its senior leaders have committed time and resources 
to advancing cybersecurity efforts at federal agencies and to promoting 
critical infrastructure sectors’ use of a cybersecurity framework, 

However, securing cyber assets remains a challenge for federal 
agencies. Continuing challenges, such as shortages in qualified 
cybersecurity personnel and effective monitoring of, and continued 
weaknesses in, agencies' information security programs need to be 
addressed. 

Until the White House and executive branch agencies implement the 
hundreds of recommendations that we and agency inspectors genera! 
have made to address cyber challenges, resolve identified deficiencies, 
and fully implement effective security programs and privacy practices, a 
broad array of federal assets and operations may remain at risk of fraud, 
misuse, and disruption, and the nation’s most critical federal and private 
sector Infrastructure systems will remain at increased risk of attack from 
adversaries. In addition to the recently passed laws addressing 
cybersecurity and the protection of critical infrastructures, Congress 
should also consider amending applicable laws, such as the Privacy Act 
and E-Government Act, to more fully protect PI! collected, used, and 
maintained by the federal government. 
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The Department of the Interiors (Interior) continued efforts to improve its 
management of federal oil and gas resources since we placed these 
issues on the High Risk List In 201 1 have resulted in the department 
meeting one of the criteria for removal from our High Risk List — 
leadership commitment. Interior has implemented a number of strategies 
and corrective measures to help ensure the department collects its share 
of revenue from oil and gas produced on federal lands and waters. 
Additionally, Interior is developing a comprehensive approach to address 
its ongoing human capital challenges, in November 2014, interior senior 
leaders briefed us on the department's commitment to address the high- 
risk issue area by describing the following corrective actions. 

• To help ensure Interior collects revenues from oil and gas produced 
on federal lands and waters, Interior has taken steps to strengthen its 
efforts to improve the measurement of oil and gas produced on 
federal leases by ensuring a link between what happens in the field 
(measurement and operations) and what is reported to Interior’s 
Office of Natural Resources Revenue or ONRR (production volumes 
and dispositions). To ensure that federal oil and gas leases are 
inspected, interior is hiring inspectors and engineers with an 
understanding of metering equipment and measurement accuracy. 
The department has several efforts under way to assure that oil and 
gas are accurately measured and reported. For example, ONRR 
contracted for a study to automate data collection from production 
metering systems. In 2012, the Bureau of Safety and Environmental 
Enforcement hired and provided measurement training to a new 
measurement inspection team. To better ensure a fair return to the 
federal government from leasing and production activities from federal 
offshore leases, interior raised royalty rates, minimum bids, and rental 
rates. For onshore federal leases, according to Interior’s November 
2014 briefing document. ONRR's Economic Analysis Office will 
provide the Bureau of Land Management (BLM) monthly analyses of 
global and domestic market conditions as BLM initiates a rulemaking 
effort to provide greater flexibility in setting onshore royalty rates, 


• To address the department’s ongoing human capital challenges. 
Interior is working with the Office of Personnel Management to 
establish permanent special pay rates for critical energy occupations 
in key regions, such as the Gulf of Mexico. Bureau managers are 
being trained on the use of recruitment, reiocation, and retention 
incentives to improve hiring and retention. Bureaus are implementing 
or have implemented data systems to support the accurate capture of 
hiring data to address delays in the hiring process. Finally, Interior is 
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competencies needed to achieve current and future program goals. 
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To address its revenue collection challenges, interior will need to identify 
the staffing resources necessary to consistently meet its annual goals for 
oil and gas production verification inspections. Interior needs to continue 
meeting its time frames for updating regulations related to oil and gas 
measurement and onshore royalty rates. It will also need to provide 
reasonable assurance that oil and gas produced from federal leases is 
accurately measured and that the federal government is getting an 
appropriate share of oil and gas revenues. 

To address its human capital challenges, Interior needs to consider how it 
will address staffing shortfalls over time in view of continuing hiring and 
retention challenges. It will also need to implement its plans to hire 
additional staff with expertise in inspections and engineering, interior 
needs to ensure that it collects and maintains complete and accurate data 
on hiring times— such as the time required to prepare a job description, 
announce the vacancy, create a list of qualified candidates, conduct 
interviews, and perform background and security checks — to effectively 
implement changes to expedite its hiring process. 

The Centers for Medicare & Medicaid Services (CMS), in the Department 
of Health and Human Services (HHS). administers Medicare, which has 
been on the High Risk List since 1990.'’® CMS has continued to focus on 
reducing improper payments in the Medicare program, which has resulted 
in the agency meeting our leadership commitment criterion for removal 
from the High Risk List and partiaiiy meeting our other four criteria. HHS 
has demonstrated top leadership support for addressing this risk area by 
continuing to designate "strengthened program integrity through improper 
payment reduction and fighting fraud” an HHS strategic priority and, 
through its dedicated Center for Program Integrity, CMS has taken 
multiple actions to improve in this area. For example, as we 
recommended in November 2012, CMS centralized the development and 
implementation of automated edits — prepayment controls used to deny 
Medicare claims that should not be paid — based on a type of national 


Medicare program has been on the High Risk List since 1990 but given the 
importance of sustained Medicare integrity to protecting federal dollars, vje are focusing 
this high-risk rating and assessment on CMS's efforts to reduce Medicare improper 
payments- 
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policy called national coverage determinations. Such action wiii ensure 
greater consistency in paying only those Medicare claims that are 
consistent with national policies. 

In addition, CMS has taken action to implement provisions of the Patient 
Protection and Affordable Care Act that Congress enacted to combat 
fraud, waste, and abuse in Medicare. For instance, in March 2014, CMS 
awarded a contract to a Federal Bureau of Investigation-approved 
contractor that vwll enable the agency to conduct fingerprint-based 
criminal history checks of high-risk providers and suppliers. This and 
other provider screening procedures will help block the enrollment of 
entities intent on committing fraud. 

CMS made positive strides, but more needs to be done to fully meet our 
criteria. For example. CMS has demonstrated leadership commitment by 
taking actions such as strengthening provider and supplier enrollment 
provisions, and improving its prepayment and postpayment claims review 
process in the fee-for-service (FFS) program. However, ail parts of the 
Medicare program are on the Office of Management and Budget’s list of 
high-error programs, suggesting additional actions are needed. By 
implementing our open recommendations, CMS may be able to reduce 
improper payments and make progress toward fulfilling the four 
outstanding criteria to remove Medicare improper payments from our 
High Risk List. The following summarizes open recommendations and 
procedures authorized by the Patient Protection and Affordable Care Act 
that CMS should implement to make progress toward fulfilling the four 
outstanding criteria to remove Medicare improper payments from our 
High Risk List. CMS should 

• require a surety bond for certain types of at-rlsk providers and 
suppliers; 

• publish a proposed rule for increased disclosures of prior actions 
taken against providers and suppliers enrolling or revalidating 
enrollment in Medicare, such as whether the provider or supplier has 


’’^Medicare consiste of four parts. Parts A and B are known as Medicare FFS. Part A 
covers hospital and ofter inpatient stays and Part B covers hospital outpatient, physician, 
and other services. Part C. also known as Medicare Advantage, is the private plan 
alternative to Medicare FFS under which beneficiaries receive benefits through private 
health plans. Part D is the outpatient prescription drug benefit. 
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been subject to a payment suspension from a federal health care 
program; 

establish core elements of compliance programs for providers and 
suppliers; 

improve automated edits that identify services billed in medically 
unlikely amounts; 

develop performance measures for the Zone Program integrity 
Contractors v\rho explicitly link their work to the agency’s Medicare 
FFS program integrity performance measures and improper payment 
reduction goals; 

reduce differences between contractor postpayment review 
requirements, v\4ien possible; 

monitor the database used to track Recovery Auditors’ activities to 
ensure that all postpayment review contractors are submitting 
required data and that the data the database contains are accurate 
and complete; 

require Medicare administrative contractors to share information about 
the underlying policies and savings related to their most effective 
edits; and 

efficiently and cost-effectively identify, design, develop, and 
implement an information technology solution that addresses the 
removal of Social Security numbers from Medicare beneficiaries’ 
health insurance cards. 
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The NationaJ Oceanic and Atmospheric Administration (NOAA) has made 
progress toward improving its ability to mitigate gaps in weather sateiiite 
data since the issue was placed on the High Risk List in 2013. NOAA has 
demonstrated leadership on both its polar-orbiting and geostationary 
satellite programs by making decisions on how it plans to mitigate 
anticipated and potential gaps, and in making progress on multiple 
mitigation-relat^ activities. !n addition, the agency implemented our 
recommendations to improve its polar-orbiting and geostationary sateiiite 
gap contingency plans. Specifically, in September 2013, we 
recommended that NOAA establish a comprehensive contingency plan 
for potential polar satellite data gaps that was consistent with contingency 
planning best practices. In February 2014, NOAA issued an updated plan 
that addressed many, but not ail, of the best practices. For example, the 
updated plan includes additional contingency alternatives: accounts for 
additional gap scenarios; identifies mitigation strategies to be executed; 
and identifies specific activities for implementing those strategies along 
with associated roles and responsibilities, triggers, and deadlines, 


GAO -vv., lysis, i xoi5tii8hF;ii,kus{GAi>t:>-3riT in additioH, in September 2013, we reported that while NOAA had 

established contingency plans for the loss of geostationary satellites, 
these plans did not address user concerns over potential reductions in 
capability and did not identify alternative solutions and timelines for 
preventing a delay in the Geostationary Operational Environmental 
Sateilite-R (GOES-R) launch date. We recommended the agency revise 
its contingency plans to address these weaknesses. In February 2014, 
NOAA released a new satellite contingency plan that improved in many, 
but not all, of the best practices. For example, the updated plan clarified 
requirements for notifying users regarding outages and impacts and 
provided detailed information on responsibilities for each action in the 
plan. 


NOAA has demonstrated leadership commitment in addressing data gaps 
of its polar-orbiting and geostationary weather satellites by making 
decisions about how to mitigate potential gaps and by making progress in 
implementing multiple mitigation activities. However, capacity concerns — 
including computing resources needed for some polar satellite mitigation 
activities and the limited time available for integration and testing prior to 
the scheduled launch of the next geostationary satellite — continue to 
present challenges. In addition, while both programs have updated their 
sateiiite contingency plans, work remains to implement and oversee 
efforts to ensure that mitigation plans will be viable if and when they are 
needed. 
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Sustaining Attention 
on High-Risk 
Programs 


Overall, the government continues to take high-risk problems seriously 
and is making long-needed progress toward correcting them. Congress 
has acted to address several individual high-risk areas through hearings 
and legislation. Our high-risk update and high-risk website, 
http://www.gao.gov/highrisk/, can help inform the oversight agenda for the 
1 14th Congress and guide efforts of the administration and agencies to 
improve government performance and reduce waste and risks, in support 
of Congress and to further progress to address high-risk issues, we 
continue to review efforts and make recommendations to address high- 
risk areas. Continued perseverance in addressing high-risk areas will 
ultimately yield significant benefits. 


Thank you, Chairman Johnson, Ranking Member Carper, and Members 
of the Committee. This concludes my testimony. I would be pleased to 
answer any questions. 

For further information on this testimony, please contact J. Christopher 
Mihm at (202) 512-6806 or mihmj@gao.gov, Contact points for the 
individual high-risk areas are listed in the report and on our high-risk web 
site. Contact points for our Congressional Relations and Public Affairs 
offices may be found on the last page of this statement. 
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Why GAO Did this Study 

!rr 201 3,. VA. estimated that about 
1 .5 .miiiron veterans required mental , 
health care, including services for 
MDD. MOD is a debilitating mental 
illness related to reduced quality of life 
and productivity, and increased risk for 
suicide. VA also plays a role in suicide 
prevention, GAO was asked to review 
how VA tracks veterans prescnbed 
antidepressants and what suicide data 
VAuses in itsprevention efforts. - 

This report examines (1) VA’s data on 
veterans with MOD. , including those 
prescribed an antidepressant; (2) the 
extent that veterans with MDD who are 
prescribed antidepressants leceive 
recommended care and the extent to 
which. VA monitors such care; and 
(3) the, quality of date VA requires 
VAMCs to collect.ori veteran.suicides, 
GAO analyzed VA data. Interviewed 
VA officiats, arid conducted sit© visits - 
to six VAMCs selected .based on 
geography and population served. 
Prom each: of these six VAMCs, GAO 
also-reviewed five randomly selected 
medicafiFsfflords for veterans 
diagnosed with MDD and prescribed 
an antldepressantin 2012, as well as 
all completed BHAP templates The 
results sannof be generalized across 
VA but pravid© Insights. 

What GAO Recommends 

GAO recommends that VA identify and 
.addf'essiMDDcodingdtscrepancies; 
implement- processes to review data 
and-assess.:^devfationsfrom ' 
recommended care; and implement 
processes to improve completeness, 
accuracy, and consistency of veteran 
suicide data, VA concurred with GAO's 
recommendations and described its • 
plans to implement them. , 

View GAO-15r55. For.more informatton, 
contact Randall' B-'Williamson at (202) 512- 
71 1 4, or •willtamsor!f@gao-gov. 
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VA HEALTH CARE 

Improvements Needed in Monitoring Antidepressant 
Use for Major Depressive Disorder and in Increasing 
Accuracy of Suicide Data 


What GAO Found 

GAO'S analysis of Department of Veterans Affairs (VA) data for fiscal years 2009 
through 2013 shows mat about 10 percent of veterans who received VA health 
care services were diagnosed with major depressive disorder (MDD). MDD is 
characterized by depressed mood or loss of interest along with other symptoms 
for 2 weeks or more that represent a change in the way individuals function from 
their previous behaviors. Because GAO found diagnostic coding discrepancies in 
1 1 of the 30 veterans' medical records it reviewed from six VA medical centers 
(VAMC), VA's data may understate the prevalence of MDD among veterans 
being treated through VA, to the extent that such discrepancies may permeate 
VA’s data. One treatment for MDD is the use of medications such as 
antidepressants. According to GAO's analysis, 94 percent of veterans diagnosed 
with MDD were prescribed at least one antidepressant. 

VA policy states that antidepressant treatment must be consistent with VA's 
current ciinicai practice guideline (CPG); however, GAO’s review of 30 veterans’ 
medical records identified deviations from selected MDD CPG recommendations 
for most veterans reviewed. For example, 26 of the 30 veterans were not 
assessed using a standardized assessment tool at 4 to 6 weeks after initiation of 
treatment, as recommended in the CPG. Additionally, 10 veterans did not receive 
fotiow up within the time frame recommended in the CPG. GAO found that VA 
does not have a system-wide process in place to identify and fully assess 
whether the care provided is consistent with the CPG, As a result, VA does not 
know the extent to which veterans with MDD who have been prescribed 
antidepressants are receiving care as recommended in the CPG and whether 
appropriate actions are taken by VAMCs to mitigate potentially significant risks to 
veterans. 

The demographic and clinical data that VA collects on veteran suicides were not 
always complete, accurate, or consistent. VA's Behavioral Health Autopsy 
Program {BHAP} is a quality initiative to improve VA’s suicide prevention efforts 
by identifying information that VA can use to develop policy and procedures to 
help prevent future suicides. The BHAP templates are a mechanism by which VA 
collects suicide data from VAMCs review of veteran medical records. GAO's 
review of 63 BHAP templates at five VAMCs found that 40 of the templates that 
VAMCs submitted to VA Central Office had incomplete data. Also. GAO found 
that the BHAP templates VAMCs submitted contained inaccurate data. For 
example. 6 BHAP templates included a date of death that was incorrect based on 
information in the veteran's medical record, and 9 BHAP templates included an 
incorrect number of outpatient VA mental health visits in the last 30 days. 
Moreover, GAO found that VAMCs submitted inconsistent information because 
they inteipreted VA's guidance on completing the BHAP templates differently. 
This situation was furtiier exacerbated because BHAP templates prepared by 
VAMCs are generally not being reviewed at any level within the Department for 
completeness, accuracy, and consistency. Lack of complete, accurate, and 
consistent data and poor oversight can inhibit VA’s ability to identify, evaluate, 
and improve ways to better inform its suicide prevention efforts. 
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Solutions 

VA 

Department of Veterans Affairs 

VAMC 

Veterans Affairs medical center 

VISN 

Veterans integrated Service Network 
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cm 

441 G St. N.W. 
Washington, DC 20548 


GOVERNMENT ACCOUNTABH.ITY OFFICE 


November 12, 2014 

The Honorable Mike Coffinan 
Chairman 

Subcommittee on Oversight and Investigations 
Committee on Veterans’ Affairs 
House of Representatives 

Dear Mr. Chairman: 

In 201 3. the Department of Veterans Affairs (VA) estimated that about 
1.5 million veterans required mental health services, which VA provides in 
a variety of settings, including VA medical centers (VAMC), community- 
based outpatient clinics, and residential treatment programs. Mentai 
health treatment includes services for depression — a mood disorder that 
causes a persistent feeling of sadness and loss of interest. One type of 
depression, major depressive disorder (MDD), is a particularly debilitating 
mental illness and Is associated with reduced quality of life, reduced 
productivity, and increased risk for suicide. These negative effects 
underscore the importance of timely, evidence-based assessment for and 
treatment of MDD. which may include medications, such as 
antidepressants, psychotherapy, or a combination of both. Treatment of 
veterans with MDD can improve their occupational and social functioning 
and their overall well-being. 

In addition to providing ongoing care to veterans with MDD, VA plays a 
role in suicide risk assessment and prevention among veterans. 

According to VA. about one-quarter of the 18 to 22 veterans who die by 
suicide each day were receiving care through VA,^ Research has 
identified numerous risk factors for suicide among veterans, which include 
substance use disorder, physical impairments, previous suicide attempts, 
and depression. Additionally, life stressors, such as marital or financial 
problems, contribute to a veteran's risk of suicide. 


’’For purposes of this report, references to VAMCs include the associated community' 
based outpatient clinics. 

^VA/Department of Defense (DOD) Assessment and Management of Risk for Suicide 
Working Group, VA/DOO Clinical Practice Guideline for Assessment and Management of 
Patients at Risk for Suicide (June 2013). 
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Given the debilitating effects of depression, VA’s monitoring of veterans 
with MDD is critical to ensuring positive health outcomes. Additionally, the 
relatively high veteran suicide rate makes it important that VA effectively 
employs data related to suicides in its prevention efforts. You asked us to 
review how VA tracks and manages veterans prescribed antidepressants 
and what suicide data VA uses in its suicide prevention efforts. In this 
report, we examine 

1 . the data VA has on veterans with MDD, including the extent to which 
they were prescribed antidepressants; 

2. the extent to which veterans with MDD who are prescribed an 
antidepressant receive recommended care and the extent to which 
VA monitors such care; and 

3. the information VA requires VAMCs to collect on veteran suicides. 

To examine the data VA has on veterans with MDD, including the extent 
to which veterans were prescribed antidepressants, we analyzed national 
VA data from fiscal years 2009 through 201 3 and interviewed VA 
officials.^ The data we analyzed included information on veterans’ 
demographic characteristics, health care services, and medications 
provided through VA.** We considered a veteran to have MDD if, in at 
least one fiscal year included in our review, the veteran had two or more 
outpatient encounters or at least one inpatient hospital stay associated 
with a diagnosis of MDD.® To ensure the reliability of the data we 
analyzed, we interviewed VA Centra! Office officials, reviewed relevant 
documentation and veterans’ medical records, and conducted electronic 


®Data on whether veterans served during recent conflicts in Iraq and Afghanistan came 
from DOD. 

‘‘The data include health care services and medications provided by non-VA providers but 
paid for by VA through its Non-VA Medical Care Program, formerly known as the Fee 
Basis Program, Non-VA medical care is the practice of paying for veterans' health care 
services outside of VA when VA medical facilities are not feasibiy available. 

®The definition of MDD as defined in the fourth edition of the Diagnostic and Statistical 
Manual of Mental Disordem was effective for a majority of the time period that our study 
covers. According to the American Psychiatric Association, the core symptoms and 
duration of these symptoms to meet the definition of MDD have not changed from the 
fourth to fifth edition of the manual. American Psychiatric Association, Diagnostic and 
Statistical Manual of Mental Disorders, 4*" ed., Text Revision (DSM-iV-TR) (Washington, 
D.C.; American Psychiatric Association. 2000), 
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testing to identify missing data and obvious errors,® On the basis of these 
activities, we determined that the data we analyzed were sufficiently 
reliable for our purposes. We also conducted site visits to 6 of the 1 50 
VAMCs selected for variation in complexity of health care services 
offered, geographic location, and number of veterans using mental health 
services. These six VAMCs were located in Canandaigua, New York; 
Gainesville. Florida; Iowa City, Iowa; Philadelphia, Pennsylvania; 

Phoenix, Arizona; and Reno, Nevada.^ At each site, we interviewed 
VAMC staff about the data maintained on veterans diagnosed with MOD. 
in addition, we reviewed a random, nongeneraiizeable sample of medical 
records for five veterans treated at each of the six VAMCs for a total of 30 
veterans. We selected veterans for review that were diagnosed with MDD 
and had a new treatment episode of an antidepressant in calendar year 
2012. Starting with the initial encounter in 2012 that was associated with 
the new antidepressant prescription, we reviewed the medical records to 
determine if the diagnostic code entered for subsequent encounters was 
consistent with a diagnosis of MDD. 

To analyze the extent to which VA monitors whether veterans with MDD 
who are prescribed an antidepressant receive care as recommended by 
VA’s clinical practice guideline (CPG) for MDD, we reviewed VA policy 
documents and interviewed VA Central Office officials responsible for 
developing and implementing VA mental health policy.® We identified the 
oversight processes VA has in place to monitor the recommendations in 
the CPG and assessed whether this oversight provides VA with adequate 
information to identify nonconformance with recommended practices, 
assess the risk, and address nonconformance, as appropriate. We 
selected three CPG recommendations for inclusion in our review that had 


^Throughout the report, we use the phrase medical records to refer to electronic medical 
records. 

^In contrast to the other site visits, which were completed In person, we completed the site 
visits to the VAMCs located in Gainesville. Florida, and Reno, Nevada, virtually through 
telephone interviews. 

®The MDD CPG is formally known as the VA/DOD Clinical Practice Guideline for 
Management of Major Depressive Disorder {May, 2009), The MDD CPG was issued by 
the joint VA/DOD Evidence-Based Practice Work Group in 2009. Formed in 1399 and 
composed of VA and DOO officials, the VA/OOD Evidence-Based Practice Work Group 
makes decisions about which CPGs for spedffc conditions will be developed and 
oversees their dewlopment. VA's Office of Mental Health Services is responsible for 
developing mental health policy and the Office of Mental Health Operations (OMHO) is 
responsible for implementing these policies. 
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among the highest strength of research evidence, were sufficiently 
specific to enable us to determine the extent to which VA providers were 
following the recommendation, and would not require clinical judgment to 
determine the extent to which VA providers were following the 
recommendation.® To examine how the recommendations we selected 
were implemented, we reviewed the 30 medical records from our selected 
six VAMCs to assess the extent to which the antidepressant treatment- 
related care VAMCs provided was consistent with the CPG 
recommendations. We also interviewed VAMC officials regarding the care 
provided to veterans with MOD prescribed an antidepressant. Results 
from our 30 medical record reviews cannot be generalized to the VAMC 
visited or other VAMCs. 

To analyze the information VA requires VAMCs to collect on veteran 
suicides, we reviewed VA policies, guidance, and documents related to 
VA’s suicide prevention efforts to identify the data collected by VA staff on 
veteran suicides. We also interviewed VA Central Office and other 
officials responsible for VA’s suicide prevention program. Additionally, 
through the site visits to six VAMCs, we obtained documents and 
interviewed officials regarding the collection of veteran suicide data and 
suicide prevention initiatives. We compared 63 data templates related to 
veteran suicides completed by VAMC staff as of the date of our site 
visits— or the date of our request for virtual site visits— to information 
included in the veterans’ medical records and to templates we received 
from VA Central Office.''® We identified fields in the documents to review 
based on whether the field related to aspects of VA treatment— including 
treatment for mental health conditions — and the date of the veteran's 
death. We identified these fields because they did not require clinical 


®The three recommendations related to nionitoring veterans prescribed antidepressants 
from the CPG that we judgmentatty selected were (1 ) to enhance antidepressant 
treatment, veterans should be educated on when to take the medication, possible side 
effects, risks, and the expected duration of treatment; (2) standardized assessments of 
depressive symptoms should be used to monitor treatment response at 4-6 weeks after 
initiation of treatment, after each change in treatment, and periodically thereafter until full 
remission is achieved: and (3) a plan should be developed that addresses the duration of 
antidepressant treatment. 

’®The Behavioral Health Autopsy Program (8HAP) Post-Mortem Chart Analysis Template 
(BHAP template) is a mechanism by which VA Central Office collects veteran suicide data 
from VAMCs’ review of veterans' medical records. One BHAP template had been 
completed as of the time of our site visit, but had not been received by VA Centra! Office; 
therefore, we did not include ftiis template in our review. 
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judgment to assess. Results from our review of veteran suicide data can 
be generalized to the VAMCs we visited, but cannot be generalized to 
other VAMCs. We also interviewed relevant staff of the six Veterans 
Integrated Service Networks (ViSN), or regional networks of care, for the 
sites we visited to obtain information on suicide prevention efforts in that 
V!SN,^^ 

For more information on our scope and methodology, see appendix I, 

We conducted this performance audit from November 2013 to November 
2014 in accordance with generally accepted government auditing 
standards. Those standards require that we plan and perform the audit to 
obtain sufficient, appropriate evidence to provide a reasonable basis for 
our findings and conclusions based on our audit objectives. We believe 
that the evidence obtained provides a reasonable basis for our findings 
and conclusions based on our audit objectives. 


Background 


VA provides care to veterans with mental health needs through its 1 50 
VAMCs, which may include both specialty mental health care settings — 
including mental health clinics — and other settings that may provide 
mental health services but focus primarily on other types of care, such as 
primary care. VA has implemented a program to co-!ocate mental health 
care providers within primary care settings in an effort to promote 
effective treatment of common mental health conditions in the primary 
care environment while allowing mental health specialists to focus on 
veterans with more severe mental illnesses. 


Care for Veterans with According to VA, the prevalence of MOD in primary care settings among 

MOD veterans being treated through VA is higher than that among the general 

population, MOD is characterized by the presence of depressed mood or 
loss of interest or pleasure along with other symptoms for a period of at 


^’Each VAMC is assigned to a single VISN. 


Page 5 


GAO-15-55 VA Psychiatric Medications and Suicide Data 



88 


least 2 weeks that represent a change in previous functioning,'’^ VA has 
policies and guidance in place related to treating veterans with MDD. For 
example, the Uniform Mental Health Services in VA Medical Centers and 
Clinics handbook (Handbook), which defines VA’s minimum clinical 
requirements for mental health services, requires that VA facilities provide 
evidence-based treatment through the administration of medication, when 
indicated, consistent with the MDD CPG.'’^ The CPG is guidance intended 
by VA to reduce current practice variation between clinicians and provide 
facilities with a structured framework to help improve patient outcomes. 

The MDD CPG provides evidence-based recommendations as guidance 
for clinicians who provide care for veterans with MDD, The MDD CPG 
includes approximately 200 recommendations to provide information and 
assist in decision making for clinicians who provide care for adults with 
MDD.’® For example, the CPG recommends that standardized 
assessments of depressive symptoms, such as the nine item Patient 
Health Questionnaire {PHQ-9), should be used at the initial assessment 
of MDD symptoms, to monitor treatment response at 4-6 weeks after 
initiation of treatment, after each change in treatment, and periodically 


’^These symptoms include significant weight loss; insomnia or excessive sleeping; 
psychomotor agitation or retardation; fatigue or loss of energy; feelings of worthlessness 
or excessive or inappropriate guilt; diminished ability to think or concentrate, or 
indecisiveness; and recurrent thoughts of death, recurrent suicidal ideation without a 
specific plan, or a suicide attempt or a specific plan for committing suicide, American 
Psychiatric Association, Diagnostic and Statistical Manual of Mental Disorders. 5’^ ed. 
(Arlington, VA; American Psychiatric Association, 2013), 

’Veterans Health Administration Handbook 1 160,01, Uniform Mental Health Services in 
VA Medical Centers and Clinics (Sept. 1 1 , 2008). The Handbook also requires that 
VAMCs provide evidence-based psychotherapy, such as Cognitive Behavioral Therapy, to 
veterans when appropriate. However, these services fall outside the scope of our review. 

’^The CPG also states that it is intended to "identify outcome measures to support the 
development of practice-based evidence that can ultimately be used to improve the 
clinical guidelines." 

’®The CPG is based on a review of research outcomes available at the time of pubiication. 
Evidence-based care refers to approaches that have consistently been shown in 
controlled research to be effective for a particular condition or conditions. 

’®The CPG for MDD is organized into 22 main topics, such as ''initial treatment" and 
"treatment response.” Each main topic contains a number of action statements that relate 
to approximately 200 recommendations for the management of veterans with MDD. 
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thereafter until full remission is achieved.’'^ Evidence shows that follow-up 
assessment is effective 4-6 weeks after initiation of treatment, making 
timely foliow-up visits an important part of clinicians’ ability to assess 
whether the cuirent treatment plan is effective or should be modified. 
According to the MDD CPG, veterans with MOD treated with 
antidepressants should be closely observed, particularly at the beginning 
of treatment and following dosage changes, to maximize veterans' 
recovery and to mitigate any negative treatment effects, including 
worsening of depressive symptoms. The CPG should not take the place 
of the clinician's clinical judgment. 


VA Suicide Prevention Beginning in June 2006, VA implemented several initiatives aimed at 

Efforts suicide prevention, including appointing a National Suicide Prevention 

Coordinator, developing data systems to increase understanding of 
suicide among veterans and inform VA suicide prevention programs, and 
instituting suicide prevention programs in VAMCs throughout the country. 
Additionally, VA Central Office established the Center of Excellence for 
Suicide Prevention and the Veterans Crisis Line in 2007. The Center of 
Excellence collects VA suicide prevention program data, which provides 
information on veteran suicide completions and suicide attempts for 
veterans receiving VA care, as well as those veterans not receiving VA 
care. VA's Veterans Crisis Line provides toll-free, confidential support 
24 hours per day for veterans, their families, and their friends through 
phone, online chat, or text message. In fiscal year 201 3, the Veterans 
Crisis Line fielded approximately 287,000 calls, 54,800 online chats, and 
1 1 ,300 text messages. 

As part of VAMCs' suicide prevention programs, the Handbook requires 
each VAMC to have a suicide prevention coordinator whose 
responsibilities include 

• establishing and maintaining a list of veterans assessed to be at high 
risk for suicide; 


^^The PHQ-9 is a diagnostic tool, which uses the nine MDD diagnosis symptoms as 
criteria to help clinkaans make a criteria-based diagnosis of depressive disorders and 
measure depression severity to aid treatment decisions. 

’'®The Veterar^s Crisis line can be reached by calling 1-800-273-8255 and pressing 1 , 
online at wvAv.VeteransCrisiBLine.net, or sending a text message to 838255. 
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• monitoring these high-risk veterans; 

• responding to referrals from staff and the Veterans Crisis Line; 

• collaborating with community organizations and partners; 

• training staff members who have contact with veterans at the VAMC, 
community organizations, and partners; and 

• collecting and reporting information on veterans who die by suicide 
and who attempt suicide. 

See appendix II for more information on VAMCs' tracking of veterans at 
high risk for suicide. 


VA Suicide Data VA Central Office uses several mechanisms to collect data on veteran 

suicides to help improve its suicide prevention efforts. One such 
mechanism includes data submitted by suicide prevention coordinators at 
VAMCs on known veterans who die by suicide.^® Beginning in December 
2012, VA Centra! Office began a national initiative to collect demographic, 
clinical, and other related information on veteran suicides as a quality 
improvement initiative to Improve its suicide prevention efforts by 
identifying information that can be used by VA Central Office to develop 
policy and procedures to help prevent future veteran deaths. This 
initiative, the Behavioral Health Autopsy Program (BHAP), replaced 
previous VA Central Office requirements to collect data on completed 
suicides.^^ VA Central Office officials explained that they transitioned to 
the BHAP initiative to collect more systematic and comprehensive 
information about suicides, to incorporate interviews of family members of 
those who die by suicide, and to collect more contextual information. 


’Veteran suicide data is submitted by VAMCs to VA’s Center of Exceiience for Suicide 
Prevention located in VISN 2. The Center of Excellence was created by VA Central Office, 
and for the purposes of our report, we refer to the Center of Excellence as part of VA 
Central Office. 

^®As part of this initiative, VA collects veterans’ demographic data, such as date of birth, 
date of death, race, ethnicity, and gender. VA also collects clinical data, such as the date 
of the veteran’s final VA visit, whether the final visit was outpatient or inpatient, and the 
results of mental health screens, including depression screens. 

^’Prior to BHAPs, VA Central Office required suicide prevention coordinators to complete 
a review for suicide completions and attempts that identified, for example, the contributing 
factors for the event. Suicide prevention coordinators would then complete an aggregate 
analysis of all re|x>fted veteran suicides. 
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According to VA, the BHAP quality initiative has been adapted from a 
traditional psychological autopsy research framework that emphasizes 
the importance of information from outside sources as well as from those 
within the health care setting. The BHAP initiative is being implemented 
by VA in four phases; 

• Phase 1 — Standardized chart reviews: VAMCs’ suicide prevention 
coordinators are required to complete standardized chart reviews for 
all veterans’ suicides known to VAMC staff and reported on or after 
October 1. 2012.^^ These reviews include specific information on a 
veteran’s utilization of VA health care services, as well as a veteran's 
mental health diagnoses and risk factors for suicide. VA Centra! Office 
has instructed suicide prevention coordinators to use all available 
information, including VA medical records and information from a 
veteran’s family members to complete the chart review. These 
reviews are submitted to VA Centra! Office through completion of a 
BHAP Post-Mortem Chart Analysis Template (BHAP template) and 
VA Central Office has provided suicide prevention coordinators with a 
BHAP Guide on how to complete the fields in the BHAP template. VA 
Central Office requires VAMCs to submit the BHAP template within 
30 days of VAMC staff becoming aware of a veteran’s death by 
suicide. 

• Phase 2— -Interviews with family members: In fiscal year 2013, VA 
Central Office began conducting interviews with family members of 
veterans who have died by suicide to obtain information on suicide 
risks, barriers to care, and suggestions for new programs to prevent 
suicide. 


^^VAMCs can also submit reviews for veterans who did not utilize VA health care services. 
Veterans not being seen within the VA will not have ciinical information available in VA's 
medical records, but VAMCs can report information that is known through other 
mechanisms, such as a coroner's report or the veteran's family members, if available. 
According to VA. a comprehensive suicide prevention program requires timely and 
accurate information beyond that acquired from veterans being seen in VA, Data on these 
veterans are needed to, among other things, improve understanding of suicide among ail 
veterans- 

^^Suicide prevention coordinators are responsible for asking family members if they are 
interested in participating in an interview. According to VA Centra! Office officials, a social 
woriter at VA’s Center of Excellence for Suicide Prevention conducts the family interview 
and multtple participants may be included in the interview. 
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• Phase 3 — Clinician questionnaire; This phase, which has not yet 
been implemented, will include an interview with the last provider that 
saw the veteran prior to his or her death. VA officials stated that there 
are no plans to begin this phase within calendar year 2014, and they 
have not established a future time table for implementing this phase. 

• Phase 4 — Public record review; This phase, which has also not 
been implemented, will be used to locate public records to identify 
stressors in the veteran’s life, such as a bankruptcy or divorce. 
Officials stated that there are no plans to begin this phase within 
calendar year 2014, and they have not established a future time table 
for implementing this phase. 

Since beginning the BHAP initiative, VA Central Office has internally 
Issued two interim reports on data and trends from the submitted BHAP 
templates as part of Phase 1. The reports include information for veterans 
who died by suicide, both with and without a history of VA health care 
service utilization. Analyses of data on demographic characteristics, case 
information, period of service, and risk and protective factors were 
included for all veterans. Data on clinical characteristics and indicators of 
increased risk at the time of the veteran’s last contact with a VA provider 
were limited to veterans that utilized VA health care services. 

in addition to the BHAP initiative, VA also requires VAMCs to collect and 
submit data on suicide attempts and completions through the following 
mechanisms.^'* 

• Suicide Prevention Application Network (SPAN): Through SPAN. 
VAMCs submit information to VA Central Office on the number of 
veterans that completed suicide, the number of suicide attempts, and 
indicators of suicide prevention efforts, such as outreach events 
conducted each month by suicide prevention coordinators. 


^VamC officials may send additional information to V!SN and VA officials through issue 
briefs, which document specific factual information regarding unusual incidents, such as 
deaths, disasters, or anything else that happens at a VAMC, such as a veteran suicide, 
that might generate media interest or affect care, VAMCs are also required to complete 
peer reviews for suicides that occur v/ithin 30 days of any clinical encounter with a VA 
clinician. Peer review for quality management is used when there is a need to determine 
whether a provider's actions associated with an adverse event were clinicaliy 
appropriate — ^that is, whether another provider with similar expertise would have taken 
simitar action. 


Page 10 


GAO-15-55 VA Psychiatric Medications and Suicide Data 



93 


• Suicide behavior reports; VAMC ciinicians must complete a suicide 
behavior report when they iearn that a veteran attempted or 
completed suicide and add that report to the respective veteran’s 
medical record. This report includes the date and time of the event, 
and other observations related to the suicide attempt or completed 
suicide. According to VA policy, information from suicide behavior 
reports is used for National Patient Safety reporting requirements and 
to populate SPAN. 

• Root cause analyses; Patient safety managers at VAMCs complete 
root cause analyses for suicide attempts and completed suicides 
under certain circumstances, such as when the attempt occurs at the 
VAMC during an inpatient stay or within 72 hours of being discharged 
from inpatient care. Root cause analyses are used to identify the 
factors that contributed to adverse events or close calls and any steps 
VAMCs could implement to prevent similar events in the future. 

See appendix III for how VAMC and VISN officials we interviewed told us 
they have utilized data related to suicides and suicide behavior. 


VA DatS Show That through 2013 show that about 10 percent of 

veterans who received health care services through VA were diagnosed 
1 0 Porcant of with mod, and of those, 94 percent were prescribed an antidepressant. 

VetaranS Had MDD However, due to diagnostic coding discrepancies we found in a sample of 
veterans’ medical records, VA’s data may not accurately reflect the 
and Most Wara prevalence of mod among veterans. 

Prescribed at Least 
One Antidepressant, 
but VA Data May 
Underestimate MDD 
Prevalence 
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VA Data Show About 
1 0 Percent of Veterans 
Had a Diagnosis of MDD, 
and Almost All Were 
Prescribed at Least One 
Antidepressant 


Based on our analysis of VA data from veterans’ medical records and 
administrative sources, 532,222 veterans — about 10 percent of veterans 
who received health care services through — had a diagnosis of 

MDD from fiscal years 2009 through 2013. Among those veterans, the 
majority (60 percent) were 35 to 64 years of age. Most (86 percent) were 
not veterans of the recent conflicts in Iraq and Afghanistan. In addition, 
most of these veterans were male (87 percent) and the highest proportion 
was white (68 percent) and non-Hispanic (87 percent). See table 1 for a 
summary of characteristics of veterans who had a diagnosis of MDD from 
fiscal years 2009 through 2013. 


^^This estimate is based on published Congressional Research Service data on the 
number of veterans who received health care services through VA from fiscal years 2009 
through 2013 (roughly 5.5 million). 

^®These conflicts include Operation Iraqi Freedom, Operation Enduring Freedom, and 
Operation New Dawn. 
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Table 1 ; Characteristics of Veterans Who Received Health Care through the 
Department of Veterans Affairs and had a Diagnosis of Sflajor Depressive Disorder, 
Fiscal Years 2009-2013 

Veteran characteristics 

Number of 
veterans with major 
depressive disorder 

Percentage of 
veterans with major 
depressive disorder 

Age 

18-24 

3,347 

0.6 

25-34 

54,054 

10.2 

35-44 

57,458 

10.8 

45-54 

96,321 

18.1 

55-64 

164,640 

30-9 

65-74 

115,358 

21.7 

75+ 

41,044 

7.7 

Era of service 

Recent conflicts in Iraq & Afghanistan® 75,934 

14,3 

Ail other eras 

456,288 

85,7 

Sex 

Male 

460,660 

86.6 

Female 

71,562 

13,5 

Race 

White 

361,921 

68,0 

Black 

96,511 

18,1 

Asian & Pacific Islander 

7.098 

1,3 

Native American 

3.484 

0,7 

Other'’ 

23,375 

4,4 

Not Identified 

14,727 

2,8 

Missing Information 

25,106 

4.7 

Ethnicity 

Non-Hispanic 

465,448 

87,5 

Hispanic 

38,577 

7.3 

Not Identified 

14.438 

2,7 

Missing Information 

13,759 

2,6 


Source GAOaf«^ysisofD^iln>«itofVetefan8Affe.fsaiv3DapartnieiilofDef8nsBaata. | GAO-1S-65 


Notes: N=532,222 veterans. Percentages may not equai 100 due to rounding. 

“These conflicts include Operation Iraqi Freedom. Operation Enduring Freedom, and Operatior! New 
Dawn. 

“This category includes veterans who identified themselves as Hispanic or multiple race. 
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We also found that about 499,000 of the 532,222 (94 percent) veterans 
who had a diagnosis of MDD from fiscal years 2009 through 2013 were 
prescribed at least one antidepressant. Of those veterans, the majority 
(about 73 percent) were dispensed a 12-week supply of an 
antidepressant at the start of an MDD episode. Fewer veterans (about 
58 percent) were dispensed a 6-month supply of an antidepressant over 
the course of their treatment. Receiving a 1 2-week supply of an 
antidepressant can be important for addressing depressive symptoms 
initially, while continued treatment after remission of depressive 
symptoms, such as receiving a 6-month supply of an antidepressant, is 
associated with a decreased risk of relapse, according to the CPG. 


VA’s Data May Not Fully 
Reflect the Extent to 
Which Veterans Have 
MDD Due to a Lack of 
Diagnostic Coding 
Precision by Clinicians 


Based on our review of the documentation in 30 veterans’ medical 
records from VA’s medical record system, we found that over one-third 
(11) had diagnostic coding discrepancies. Specifically, these 11 veterans 
had at least one encounter where the clinician documented a diagnosis of 
MDD in the veteran’s medical record, but the clinician did not code the 
encounter accordingly. Instead, the clinician coded the encounter as 
"depression not otherwise specified," a less specific code.^^ According to 
the fourth edition of the Diagnostic and Statistical Manual of Mental 
Disorders, depression not otherwise specified is to be used to code 
disorders with depressive features that do not meet criteria for MDD and 
other depressive disorders, or to indicate depressive symptoms about 
which there is inadequate or contradictory information.^® VA’s data on the 
number of veterans with MDD are based on the diagnostic codes 
associated with patient encounters, so the discrepancies we found 
indicate that the number of veterans with MDD is most likely not fully 
reflected in these data. Accurately identifying the veteran population with 
MDD is critical to assessing Department performance in treating veterans 
in accordance with the MDD CPG and measuring health outcomes for 
these veterans. VA Central Office reviewed the 1 1 medical records where 
we found coding discrepancies and agreed that the encounters were not 


encounter is a professional contact between a patient and a clinician in an outpatient 
or inpatient setting; a patient visit can consist of multiple encounters. 

^®Other depressive disorders include dysthymic disorder, adjustment disorder with 
depressed mood, and adjustment disorder with mixed anxiety and depressed mood. 

American Psychiatric Association; Diagnostic and Statistical Manual. Depression not 
otherwise spedfied is referred to in this edition as depressive disorder not otherwise 
specified. 
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coded accurately. According to a VA Central Office official, the 
encounters we identified were corrected in the veterans’ medical record. 

According to VHA Handbook 1907.03 - Health Information Management 
Clinical Coding Program Procedures, VAMCs are required to monitor the 
accuracy of coding and provide training as necessary in order to help 
ensure accurate coding. VAMC officials from all six sites in our review 
said that monthly or quarterly coding audits are conducted at their 
facilities and the findings of those audits are reviewed and action is taken 
to correct issues with the accuracy and reliability of coding. However, at 
five of the six VAMCs in our review, those audits focus on billable 
encounters — that is, encounters that are billed to a third party, such as 
private health insurance plans — in part because of the potential 
opportunity for facilities to collect third-party revenue from these 
encounters.^® Among the 1 1 veterans’ medical records where we 
identified coding discrepancies, all of the discrepancies were associated 
with outpatient, nonbillable encounters, the coding of which, according to 
a VA Centra! Office official, is not typically conducted by VAMC medical 
coders — staff who are trained specifically in medical coding terminology 
and standards and are responsible for coding inpatient admissions and 
discharges— or subject to coding audits. 

Diagnostic coding in VA's medical record system for outpatient 
encounters is typically performed by clinicians. ViSN officials and VA 
medical center clinicians we interviewed said that clinicians do not place a 
lot of importance on selecting a more precise diagnostic code because it 
does not significantly change the patient care that is provided or the type 
of treatment prescribed, in addition, in the interest of expediency, 
clinicians may select a previously used or frequently used diagnostic code 
for depression rather than take the time to search for a more precise 
code. For example, within the medical record, clinicians may access a list 
of previous or current diagnoses applicable to the veteran (commonly 
referred to as the "problem list") or a list of frequently used diagnostic 
codes In the facility. According to VISN and VAMC officials, the problem 
list is not typically kept up to date by clinicians and as a result, MOD may 
not be listed and readily available for clinicians to select. As a result of our 


^Officials at one VAMC in our review said that their facility conducts annual audits of 
nonbiilabie encounters, in part, to track the productivity of (heir providers and to maximiEe 
the amount of funding allocated to their facility by VA Central Office based on workload 
measures. 
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review, VA Central Office officials reported that they had discovered a 
software mapping eiror in VA’s medical record system where the 
selection of MOD as a diagnosis when using a keyword search function 
may result in the selection of the depression not otherwise specified 
diagnostic code by mistake. Officials stated that they anticipate that the 
software error— which applies to ail VAMCs — would be fixed by 
November 2014. Officials also stated that the solution would apply only to 
those encounters coded from that point going forward and would not 
retroactively correct any coding discrepancies that may have occurred 
before the error was addressed. VA Centra! Office officials could not tel! 
us if any of the 1 1 coding discrepancies that we identified were a result of 
this software error. 

Officials at most of the six VISNs we spoke with do not conduct reviews of 
medical coding done by clinicians. However, as a result of our inquiry, 
one VISN we interviewed reported in the late spring of 2014 that it had 
extracted data on MDD-related encounters and noticed the high use of 
depression not otherwise specified coding for the facilities within its ViSN. 
as well as ail VAMCs nationwide. Officials from this VISN said the lack of 
coding specificity has implications for being able to accurately examine 
health outcomes related to the treatment of depression and that they are 
planning to further analyze encounter data within their VISN to determine 
the appropriateness of diagnostic coding based upon medical record 
documentation. As of September 2014, the VISN had not reported any 
additional steps to address this issue. 


^’For example, according to a VA Central Office official, if the clinician used the keyword 
search function and searched under ttie word "major depression", "major depressive 
disorder” would be returned as a possible diagnosis choice for selection. Currently, as a 
result of the software mapping error, if this selection is made, the encounter would be 
coded as depression not ottierwise specified. 
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Based on the three CPG recommendations we selected, veterans in our 
review with MOD who have been prescribed antidepressants did not 
always receive care as recommended in the MDD CPG. Additionally, VA 
does not know the extent to which veterans with MDD who have been 
prescribed antidepressants are receiving care as recommended in the 
CPG, and VA Centra! Office has not developed mechanisms to determine 
the extent to which mental health care delivery conforms to the 
recommendations in the MDD CPG, 


Veterans We Reviewed We found that almost all of the 30 veterans with MDD who have been 

Did Not Always Receive prescribed antidepressants included in our review did not receive care in 

Care As Recommended accordance with the three MDD CPG recommendations we reviewed, VA 
policy states that antidepressant treatment must be consistent with VA’s 
current, evidence-based CPG.^^ However, VA Central Office mental 
health officials were unable to tell us what it means to provide care that is 
consistent with the CPG, because, while a veteran’s treatment should be 
informed by the CPG recommendations, determining the extent to which 
the treatment is consistent with CPG recommendations would need to be 
done on a veteran-by-veteran basis. The CPG is intended to reduce 
practice variation and help improve patient outcomes, but without an 
understanding of the extent to which veterans are receiving care that is 
consistent with the CPG. VA may be unable to ensure that it meets the 
intent of the CPG and improves veteran health outcomes. 

Through our review of 30 medical records from the six VAMCs we 
selected, we found examples of deviations from the CPG 
recommendations for almost alt veterans in our review. Table 2 below 
depicts the specific recommendations we reviewed and the number of 
veterans that did not receive care consistent with the corresponding CPG 
recommendation. 


Not All Veterans in 
Our Review Received 
CPG-Recommended 
Care and VA Lacks 
Mechanisms to 
Determine Whether 
This Care Is Provided 


^^Uniform Mental Health Services in VA Medical Centers and Clinics handbook. 

reviewed five medical records from each of the six VAMCs we selected to determine 
whether veterarts at these VAMCs were receiving care consistent with select 
recommendations from the CPG. 
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Table 2: Number of Veterans in GAO’s Sample Not Receiving Care As Recommended in the Clinical Practice Guideline (CPG) 
for Major Depressive Disorder (MDD) 

CPG recommendation 

Number of veterans not receiving care as recommended 
in the CPG for MOD 

To enhance antidepressant treatment, veterans should be educated on 
when to take the medication, possible side effects, risks, and the 
expected duration of treatment, among other things 

6 of 30 veterans lacked documentation of patient education 
when the medication was prescribed 

Standardized assessments of depressive symptoms, sud^ as the 

Patient Health Questionnaire-9, should be used to monitor treatment at 
4-6 weeks after initiation of treatment and after each diange in 
treatment 

26 of 30 veterans were not assessed using a standardized 
assessment tool at 4-6 weeks after initiation of treatment 

18 of 30 veterans were not assessed using a standardized 
assessment too! at any encounted’ 

10 of 30 veterans did not have a follow-up encounter that 
occurred 4-6 weeks after initiation of treatment^’ 

A plan should be developed that addresses the duration of 
antidepressant treatment, among other things 

1 veteran of 30 did not have a planned date for follow up 
and plan for future care documented in the veteran's 
medical record at the initial encounter 


Source. GAO analysis a( Dopartmeiit of Volerans Affairs (VAj flalo ! GAO-15^5 


Note: We indoded 30 veterans in our review. Our review began with the encounter during which a VA 
clinician ordered an antidepressant to treat depressive symptoms (initial encounter) and five fol!ow-up 
encounters with a VA clinician, or sooner if the veteran did not have five follow-up encounters. Our 
review was limited to encounters during which the antidepressant treatment was reviewed, including 
encounters during which side effects and treatment effect were assessed, but no change was made 
to medication orders. 

*Of the 30 veterans included in our review, only 6 were assessed using a standardized assessment at 
the initial encounter where antidepressant medication was prescribed. VA Central Office officials 
explained that they would expect a standardized assessment to be conducted at the start of an 
antidepressant to establish a baseline score. 

“Three veterans did not receive a foliow-up appointment at ail. Two veterans did not show for 
scheduled appointments that were within the CPG recommended time frame. Five veterans did not 
have a follow-up encounter until after 6 weeks. 

For example, the CPG recommends that veterans' depressive symptoms 
be assessed at 4-6 weeks after initiation of antidepressant treatment to 
determine the efficacy of the treatment. However, medical records of 10 
of the 30 veterans we reviewed indicated that they did not have a follow- 
up encounter within the CPG's recommended 4-6 week time frame. Of 
those 10 veterans, 

• 3 veterans did not have any follow-up encounters related to mental 
health: 

• 2 veterans did not show tor scheduled appointments that were within 
the CPG recommended time frame; and 
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• 5 veterans did not have a follow-up encounter until after 6 weeks. This 

follow up ranged from 7 weeks to 50 weeks after the initial 
encounter.^ 

Some clinicians at VAMCs we visited described instances in which they 
generally do not follow the CPG recommendations,^® For example, not all 
clinicians use a standardized assessment to evaluate a veteran’s 
symptoms. Officials from two VAMCs we visited explained that they do 
not routinely use the PHQ-9. According to one of these VAMCs, the 
standard of care is a clinical interview and observation. However, the 
CPG recommendation states that the PHQ-9 combined with a clinical 
interview should be used to obtain the necessary information about 
symptoms and symptom severity. It also states that the PHQ-9 improves 
diagnostic accuracy and aids treatment decisions by quantifying symptom 
severity. Furthermore, clinicians may also prefer different time frames for 
follow up, which are not always consistent with the CPG 
recommendation. For example, one clinician told us that he tries to see 
the veteran 3 weeks after the initial appointment, and clinicians at another 
VAMC like to see the veteran within 6 weeks, but told us that this is 
sometimes difficult due to scheduling constraints.^® 


these 5 veterans, 2 had treatment plans in the medical record that did not specify a 
time frame for follow up. One veteran returned in 7 weeks, as prescribed in the veteran's 
treatment plan. However, the remaining 2 veterans had a time frame in their treatment 
plan, but no explanation for why the follow-up encounter occurred outside this time frame. 
The first veteran’s treatment plan instructed the veteran to return in 6 weeks; however, the 
veteran's follow-up encounter occurred approximately 12 weeks after the initial encounter. 
The second veteran’s treatment plan instructed the veteran to return In 6-8 weeks, but the 
veteran was not seen until approximately 50 weeks after the initial encounter, 

®®As a result of our review, officials at one VAMC told us that they are developing plans to 
work with clinicians at the VAMC to implement measurement tools, including the PHQ-9. 

®®VA’s Office of Inspector Genera! (OIG) documented concerns about the timeliness of 
veterans' access to foiiow-up mental health care, which could affect the ability of veterans 
to receive follow-up Mth a clinician after beginning or changing antidepressant treatment, 
VA OIG. Veterans Health Administration: Review of Veterans' Access to Mental Health 
Care (Washington, D.C.: Apr. 23. 2012), 
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VA Lacks Mechanisms to VA does not know the extent to which veterans are receiving care 
Determine the Extent to consistent with the MDD CPG. while deviations from recommended 

Which Veterans Are practice may be appropriate in many cases due to clinician discretion, VA 

P . . ’ 4- ^ assessed whether these examples are acceptable deviations 

KeceiVing uare Oonsistent CPG. According to the federal Internal control standard for risk 

with CPG assessment, agencies should comprehensively identify risks, assess the 

Recommendations possible effects, if any, and determine what actions should be taken to 

mitigate any significant risks. VA Central Office has not developed a 
mechanism to fully identify deviations that could impede veterans' 
recovery that may result when VAMCs do not provide care consistent with 
the MDD CPG. VA Centra! Office officials explained that the CPG 
recommendations are guidelines that clinicians can use to inform and 
guide clinical decision making. VA officials told us that VA cannot require 
the use of all recommendations in all cases; rather, CPG 
recommendations should be applied on a case-by-case basis based on 
the needs of the veteran and with clinician judgment, One official also 
said it would be difficult to check every CPG recommendation to ensure 
that clinicians are providing care consistent with the CPG, but stated that 
VA could identify for review those recommendations that may put 
veterans’ health at risk if not followed. However, with no mechanism to 
assess whether the care provided is consistent with the CPG, VA is 
unable to ensure that deviations from recommended care are identified. 

While monitoring full compliance with CPG recommendations may be 
difficult, there are nevertheless ways to address the issue. In fact, VA 
Central Office and some VAMCs have implemented mechanisms to 
determine the extent to which veterans are receiving care that is 
consistent with some of the CPG recommendations; however, these 
mechanisms do not fully assess all deviations that could impede a 
veteran's recovery, as illustrated by the following. 


a June 2014 report, the Institute of Medicine also raised concerns with VA clinicians’ 
adherence to CPG recommendations. This report reviewed the VA/DOD Clinical Practice 
Guideline for Management of Post-Traumatic Stiess and stated that VA does not have a 
mechanism for the systematic collection and analysis of data for assessing the quality of 
care for post-traumatic stress disorder and that, as a result, VA often does not know 
whether veterans have received evidence-based treatments or whether these treatments 
are producing positive outcomes. The Institute of Medicine recommended that VA use 
evidence-based treatments as the treatment of choice for post-traumatic stress disorder, 
and these treatments should be delivered with fidelity to their established protocois. 
institute of Medidne. Treatment for Posttraumalic Stress Disorder in Military and Veteran 
Populations Report Srfef (Washington. D C.; June 2014). 
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In fiscal year 2014, VA began to review mental health care delivery at 
VAMCs through a psychopharmacoiogy quality improvement initiative 
consisting of a series of prescribing practices metrics, although this 
initiative does not fully assess the extent to which care is consistent 
with the MDD CPG.^ One metric — the proportion of veterans with 
depression prescribed three or more concurrent antidepressant 
medications for 60 or more continuous days — relates to 2 of the over 
200 MDD CPG recommendations.^® According to one VA Central 
Office official, the initial phase of the initiative is focused on 
decreasing variability in prescribing practices among VAMCs, To start 
the initiative, VA compiled metric profiles for each VAMC, which 
included a description of how each VAMC perfonned for all metrics as 
well as the performance of each VAMC relative to the VISN and 
national averages. VA requires that all VAMCs address metrics where 
performance was lower than the national average. Currently, VA is 
assisting VAMCs with developing action plans to address these 
metrics. Because the initiative is in the early stages, it is too soon to 
determine how VA Central Office and VAMCs will review and remedy 
deviations from the two CPG recommendations addressed by this 


^^A’s OMHO developed the psychopharmacoiogy initiative in fiscal year 2014. This 
initiative is intended to address four areas: (1) possible overprescribing, (2) possible 
problems in clinical management, (3) misalignment between prescribing and diagnosis, 
and (4) missed opportunities. The metrics generally assess all veterans with any 
depression diagnoses, such as depression not otherwise specified; only one metric is 
specific to MDD, VA Central Office officials explained that data for this initiative are pulled 
from clinical and administrative records, but that extracting data can be challenging 
because, for example, clinicians may not be recording data in an extractable field in the 
medical record. VA Central Office officials also told us that they collect data on the number 
of veterans who receive 12-week and 6-month supplies of antidepressant medication, 
which relates to a CPG recommendation stating that, for veterans who achieve remission 
with antidepressants, treatment should be continued at the same dose for an additional 8- 
12 months to decrease the risk of relapse. VA/DOD Clinical Practice Guideline for 
Management of Major Depressive Disorder (May, 2009) pg. 73. 

^^Specifically, these CPG recommendations state that veterans who are diagnosed with 
MDD should receive an initial trial of a single antidepressant, and that a second 
antidepressant medication may be considered for veterans who have had a partial 
response to treatment with one antidepressant. VAA)OD Clinical Practice Guideline for 
Management of Major Depressive Disorder{May, 2009). Other antidepressant metrics 
include: the proportion of veterans with depression receiving medication from three or 
more of four psychotropic classes (including antidepressants) for 60 or more continuous 
days; the proportion of inpatient or outpatient initial visits for new MDD diagnosis with 
antidepressant receipt where there is no coverage for 84 days out of the first 114 days 
following the initial antidepressant fill; and the proportion of antidepressant prescriptions 
given with no medical or psydiiatric indication. However, these metrics do not relate to 
specific recommendations in the CPG. 
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initiative. According to VA Centra! Office officials, the 
psychopharmacology quality improvement initiative is a mechanism 
VA currently has to look at CPG recommendations, and VA could add 
additional metrics addressing other CPG recommendations in the 
future. However. VA Central Office officials stated that other CPG 
recommendations would require a more in depth analysis, such as 
medical record reviews, and it would be difficult to develop metrics for 
some of the recommendations. 

• While VA Central Office does not have a mechanism to determine the 
extent to which VAMCs are providing care consistent with a majority 
of the CPG recommendations, some VAMCs have implemented a 
software system to help ensure that veterans with MDD who are 
prescribed antidepressants receive care consistent with the CPG 
when the veteran is treated in a primary care clinic.''^ At the time of 
our site visits, three of the VAMCs we visited were using such a 
system — ^the Behavioral Health Laboratory The BHL is 


'’Va also provides VAMCs data on the number of veterans screened annually using a 
standardized screening tool, a two item Patient Health Questionnaire (PHQ'2) and the 
percentage of veterans who screen positive for depression and have a timely suicide 
behavior evaluation completed. These measures meet CPG recommendations for annual 
screening for MDD and evaluation of suicide risk with a positive depression screen, 
Another mechanism VA uses to assess mental health care at VAMCs is site visits 
conducted by VA’s OMHO. During these site visits, OMHO assesses, for example, how 
the number of veterans screened annually for depression compares to the national 
average as well as any trends within the VAMC. According to OMHO, the purpose of 
these site visits is to assess mental health care at individual VAMCs, specifically 
implementation and adherence to VA standards for mental health services, Once OMHO 
has identified both exemplary areas and areas for growth, OMHO then works with the 
mental health lead at the corresponding ViSN to develop a strategic action plan for the 
VAMC, which will be monitored for implementation progress on a quarterly basis. 
However, these site visits do not look at specific CPG recommendations. 

Officials at one VAMC we visited told us that they use a clinical tool to track veterans 
being treated for mental health conditions. The mental health tool includes 67,349 unique 
patients, and an official explained that they can run queries of the clinical tool~for 
example, for veterans participating in substance abuse treatment who did not return for a 
drug screen— by putiing both process and outcome variables including diagnostic codes, 
lab results, and medication lists. 

‘‘Va policy states that VAMCs must have integrated mental health services that include 
co-iocated coilaborative care and care management. Care management can be based on 
the BHL, Translating Initiafives for Depression into Effective Solutions (TIDES), or other 
evidence-based strategies approved by the Office of Mental Health Services. According to 
VA, TIDES facilitates collaboration between primary care clinicians and mental health 
specialists with support from a depression care manager, who, under the supervision of a 
menfai health specialist, assists the primary care clinician in the assessment and ongoing 
management of depressed patients. 
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designed to manage the behavioral health needs of veterans through 
telephone or in-pereon visits. As part of the system, clinicians can use 
a structured interview— including a PHQ-9— that assesses veterans’ 
mental health symptoms in a way that is consistent with the CPG 
recommendation for follow-up assessment. Although the BHL can be 
used to help ensure care is provided consistent with a few of the 
recommendations in the CPG, the BHL is not used to monitor all 
veterans prescribed antidepressants. Generally. VAMCs use the BHL 
to monitor veterans being treated for mental health conditions, such 
as MOD, in primary care clinics, and to participate, veterans can be 
referred by their primary care clinician or request to participate.'*^ 


Demographic and 
Clinical Data VA 
Collects on Veteran 
Suicides Were Not 
Always Complete or 
Accurate, and VAMCs 
Applied Instructions 
for Gathering Suicide 
Data Differently 


We found that demographic, clinical, and other data submitted to VA 
Central Office on veteran suicides were not always completely or 
correctly entered into the BHAP Post-Mortem Chart Analysis Templates — 
a mechanism by which VA Centra! Office collects veteran suicide data 
from VAMCs’ review of veterans' medical records. (Figure 1 shows the 
number of BHAP templates we found with incomplete or inaccurate data,) 
Moreover, VAMCs interpreted and applied instructions for completing the 
BHAP templates differently. We also found that most VAMCs and VISNs 
we reviewed and VA Central Office did not review suicide data for 
accuracy. 


“’^According to officials at one VAMC we visited, clinicians previously used pharmacy data 
on a weekly basis to determine whether there were any veterans with new antidepressant 
orders from primary care who were not referred to the BHL. Officials told us that they 
stopped running the weekly query, since they consistently found that all eligible veterans 
had been referred to the BHL However, in advance of our site visit, officials ran the query 
again and noted that some veterans were not being referred to the BHL, As a result, they 
plan to resume completing the weekly queries. 
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Figure 1 ; Number of Behavioral Health Autopsy Program {BHAP) Post-Mortem Chart Analysis Templates with Incomplete or 
inaccurate Data 

incompidte and inaccurate data from BHAP templates 

Veteran was receiving Department of Veterans 
Affairs (VA) services, but BHAP tempiats did rrot 
indicate as such 

Data fields left blank 

Date of death incorrect 
Number of outpatient mental health visits incorrect 

0 9 18 27 3S 45 

Number o! BHAP templates 

CZl Number of inewnptete SIW terr^afes out of 63 
Number of inaccurate 8HAP templates out of 63 

Source: GAO analysis olVA rials. ! GAO-15-55 



Voteran Suicide Data Are We found that over half of the 63 BHAP templates we examined had 
Incomplete incomplete information-'*'' The data either lacked veteran enrollment 

information, or other specific fields were omitted. Moreover, the data were 
lacking entirely for certain known veteran suicides. Incomplete data limits 
VA Central Office’s ability to identify information that can be used to help 
VA Central Office develop policy and procedures to prevent veteran 
deaths- 

Lack of veteran enrolfment information. Approximately one-third (23) 
of the BHAP templates we reviewed did not indicate whether the veteran 
was enrolled in VA health care services, even though the veteran had a 
VA medical record,''® 


^“'We analyzed BHAP templates from five of the VAMCs at the time of our site visit or at 
the time we requested the BHAP templates. One VAMC had not completed any BHAP 
templates at the time of our site visit because they did not have a veteran die by suicide 
since the beginning of the BHAP initiative. Therefore, our analysis does not include BHAP 
templates from this VAMC. 

''®This field in the BHAP template states: “Is this case concerning a Veteran who was 
enrolled in VA Health Care Services?" For those veterans who were being seen in the VA, 
the box associated with this field should be checked. 
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• Eight did not indicate that the veteran had received VA services when 
the templates were submitted by three of the VAMCs in our review, 
even though these VAMCs provided care to these veterans. 

♦ Fifteen BHAP templates submitted by two VAMCs in our review 
originally indicated that the veteran was receiving VA care; however, 
when we reviewed the submitted BHAP templates we received from 
VA Central Office for the same 1 5 veterans, the BHAP templates did 
not indicate that the veteran was being seen in the VA,^® 

VA Central Office used enrollment information when compiling the most 
recent BHAP interim report, which is part of VA Central Office’s quality 
improvement efforts for its suicide prevention program,"*^ Specifically, VA 
Central Office included clinical data in the BHAP interim report only for 
veterans utilizing VA services. Therefore, clinical data for the 23 veterans 
we identified would not be included in the interim report. Missing one-third 
of the data from its analysis, as was the case in our sample, could have a 
detrimental effect on the trends VA Central Office reports and uses to 
improve its suicide prevention efforts. 

Requested data was omitted. Forty of the 63 BHAP templates we 
reviewed included various data fields where no response was provided, 
resulting in incomplete data. For example, for 19 templates, VAMC staff 
did not enter requested data as to whether the veteran had ali or some of 
1 5 active psychiatric symptoms within 1 2 months prior to the veteran’s 
date of death.''® Also, 9 templates did not include an answer for the 
number of previous suicide attempts by the veteran, Offtciais from one 
VAMC told us that they left this field blank if the veteran did not have any 
previous suicide attempts, rather than entering a “O,” even though the 


^®VA Central Office officials stated that this field could have become unchecked prior to 
submission of the template to Central Office, but that it was not the result of a 
programming error. For example, the box may have become unchecked after the VAMC 
offidal saved the template to a local location, but prior to the VAMC submitting the 
template to VA Central Office. 

‘'^According to one VA Central Office official, for the first interim report, officials matched 
veterans from the BHAP templates to medical record information to determine whether the 
veteran was receiving VA health care services, 

‘'®The 15 psychiatric symptoms in the BHAP template are isolation, anxiety, depressed 
mood, ruminations. suicWal ideation, sleep problems, intrusive memories, drug seeking 
behaviors, flashbacks, guiit/remorse, hallucinations, command suicide hallucination, 
alcohol withdrawal, agitation, and impulsivity. 
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BHAP Guide states that officials should enter the appropriate number of 
previous suicide attempts. Officials at one VAMC told us that fields are 
sometimes left blank if the standardized answers available on the BHAP 
template are not adequate; that is, the answer for that veteran does not fit 
Into one of the answers provided on the BHAP template. Officials at two 
VAMCs stated that it is sometimes easy to overlook fields in the BHAP 
template, resulting in unanswered questions. 

Filling in all fields in the BHAP template, rather than leaving the field 
blank, is important because some blank fields are counted as “missing" or 
"no” in the analysis conducted by VA Central Office for the BHAP interim 
reports. This, in turn, could affect the suicide trends reported. For 
example, for the number of previous suicide attempts, blank fields are 
counted as “missing" in the BHAP interim report, rather than “0” previous 
suicide attempts as officials from one VAMC intended, in other cases, 
such as for psychiatric symptoms, missing fields are counted as “no,” 
meaning that the veteran did not have these symptoms. In at least one 
BHAP template, the answer for the psychiatric symptom of isolation was 
left blank, and would therefore be counted as negative in the interim 
report despite the fact that officials from the one VAMC told us that the 
veteran did have this symptom. See figure 2, which provides an excerpt 
of the fields from the BHAP template in which VAMCs provided 
incomplete data. 


example, the template answers for psychiatric symptoms originally included “yes” 
and "no.” The template has been updated to also include "unknown," but this answer was 
not an option for all templates in our review. However, officials at hvo VAMCs provided us 
with the answers for fields that were left blank, including the fields for psychiatric 
symptoms. 
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Figure 2: Excerpts of the Department of Veterans Affairs’ (VA) Behavioraf Health Autopsy Program (BHAP) Template in Which 
Selected VA Medical Centers Submitted incomplete Data 


Investigating Clinicij 


^ This box should be checked to indicate 
whether the veteran was enrolled in VA 
health care services. 


Is the Case concealing a Veteran wlio WAS enrolled in VA Health Care Servii^s' 


Data Sources: 


JPRS OeatnC 
•amiiy r^eport ■■ 


Means at Completed Suicid e: Select- . 

Does the medical re cord show th« the Veteran called th e 
Crisis Line in the oast year? Chech if 'Yes' - ' . 


raphlcs 

SabLatesjlLv 


The corresponding bubble should be filled in 
to Indicate active symptoms the veteran may 
have experienced anytime within 12 months 
prior to the date of death." 


, No ' Unknown 
, No ' . Unknown 
, No ' , Unknown •' 
, No ' . Unknown- 
. No ■" . Unkiwvn 
,No:\ Unknown 
, No r' , Unkrtmvn r 
Nor" , Unkrwwn ' 
, No , Uttknown " 
No r . Ut^owni 
. No ■ . Unkrwjwn r 
No ". , Unknown ' 
.No ',. Unknown-' 
. No -' . Untoiown r 
, No , UrStnown ' 


This box should contain the number of 
previous suicide attempts, as indicated in the 
veteran’s electronic medical record, 


Paln7 Solea,.. 

ctivc Pain Medications? : Yes - , No 


Soiircor GAO analysts ofVAdocumems | C?A0-15'.S5 


“The BHAP template has changed over time and "unknown" has not always been an option in this 
sediion of the BHAP template. 
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Data were lacking entirely for certain known veteran suicides. We 
found that VAMCs did not always submit BHAP templates for all veteran 
suicides known to the facility, as required by the BHAP Guide, VA Central 
Office does not have a process in place to determine whether it is 
receiving the BHAP templates for all known veteran suicides. “ For 
example, one VAMC had completed 1 3 BHAP templates at the time of 
our site visit but had not submitted them; however, neither the VAMC nor 
VA Central Office were aware that these templates had not been 
submitted until after we requested them from VA Central Office, The 
suicide prevention coordinator at this VAMC told us that the BHAP 
templates were forwarded to another official at the VAMC, rather than 
being submitted through VA Central Office’s process, and that the BHAP 
templates were never submitted. As a result of our inquiry, the VAMC 
submitted these templates to VA Central Office. In another example, 
officials at a different VAMC told us that, at the time of our site visit, they 
had recently begun completing and submitting BHAP templates, 
beginning with veteran suicides occurring in fiscal year 2014. VA Central 
Office officials told us that VAMCs can start submitting BHAP templates 
at any point, and officials are not requiring the VAMCs to go back and 
submit information on all suicides since October 1, 2012. However, this 
practice is contrary to VA policy, which states that VAMCs should submit 
BHAP templates for all suicides known to the facility and reported on or 
after October 1, 2012. 


Veteran Suicide Data Are Of the 63 BHAP templates we reviewed, we found numerous instances of 
Inaccurate inaccurate data submitted on BHAP templates, as illustrated by the 

following examples. 

• Incorrect date of death: Six BHAP templates included a date of 
death that was incorrect based on information in the veteran’s medical 


®®One VA Central Office official told us that for the first BHAP interim report, officials 
matched the number of suicade behavior reports to the number of BHAP templates using 
the veterans’ social security numbers to determine that a BHAP template was submitted 
for each completed suidde behavior report. According to VA Central Office officials, this 
process was not conducted for the most recent BHAP interim report. 
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record.®^ The difference in the dates of death in the veterans’ medical 
records and the dates of death in the BHAP templates ranged from 
1 day to 1 year. For example, one BHAP template indicated that the 
veteran died in the year after the veteran’s actual date of death. 
Another BHAP template appeared to use the date the suicide 
behavior report was completed, rather than the veteran’s actual date 
of death. The suicide behavior report was completed 69 days after the 
veteran’s date of death. The accuracy of the date of death recorded 
in the BHAP template Is important because it is used as a point of 
reference to calculate other fields, such as the number of mental 
health visits in the last 30 days, 

* Incorrect number of mental health visits; Nine BHAP templates 
included the incorrect number of outpatient VA mental health visits in 
the last 30 days.®® For example, one BHAP template indicated that 
the veteran had five outpatient mental health visits, including three 
non-mental health visits that should not have been included in the 
total number of mental health visits for this veteran. Another BHAP 
template indicated the veteran had been seen once by a mental 
health provider In the last 30 days; however, we found in reviewing 
the medical records that this veteran had not been seen by a mental 
health provider during this time period. This veteran would be included 
in the BHAP interim report as having a mental health visit, and, as a 
result, VA’s data would include an inaccurate count of the number of 
veterans with mental health visits in the last 30 days,®’’ Without 
accurate information, VA cannot use this information to determine 
whether policies or procedures need to be changed to ensure that 


®’ We could not confirm date of death for two BHAP templates because the veterans’ 
medical records did not contain a date of death. When confirming the lack of date of death 
in the medical records with the VAMC, officials stated that they took the date of death for 
one of the templates from the suicide behavior report. However, we did not find a suicide 
behavior report in the veteran's medical record. 

®^Tv,?o BHAP templates had dates of death that were 1 day off, one BHAP template was 
off by 3 days, and one BHAP template had a date of death off by 5 days. 

®® Although the BHAP template asks for the number of mental health visits. VA Central 
Office officials told us that they expect VAMCs to report mental health encounters, rather 
than visits. An encounter is a professional contact between a patient and a clinician in an 
outpatient or inpatient setting; a patient visit can consist of multiple encounters, 

®‘’ According to VA Central Office officials, missing information in this field is treated as "O” 
in the interim report. 
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veterans at high risk for suicide are being seen more frequently by a 
mental health provider to help prevent suicides in the future. 

See figure 3, which provides an excerpt of the fields from the BHAP 
template in which VAMCs provided inaccurate data. 
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Figure 3: Excerpts of the Department of Veterans Affaire’ (VA) Behavioral Health Autopsy Program {BHAP) Template in Which 
Selected VA Medical Centers Submitted Inaccurate Data 



Investigating Ctiniciar 


is the Cass concerning a Veteran who WAS enroiled inVA Health Care Servi«s? 


’RS' Death Cattifk'jaie 
mily Report : 


Means ol C omple ted SukJde:$etegt_.. 

does the metlical record show that the Veteran called the 

Crisis Line m the oast ye ar? Check H'Yes' • • 





Source; GAO analysis ol VAflucumants, | GAO-15-55 


This field should include the month, date, and 
year of the veteran's death. 


This field indicates the total number of 
outpatient mentai health visits in the last 30 
days. 
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VAMCs Have Interpreted We found several situations where VAMCs interpreted and applied 
and Applied Instructions instructions for completing the BHAP templates differently, as illustrated 
for Completing the BHAP '“"““"a examples-^ 

Templates Differently , found inconsistencies in how different VAMCs arrived at answers 

provided in the BHAP templates. For example, one VAMC included a 
visit to an immunization clinic as the veteran's final visit, while another 
VAMC did not include this type of visit, even though this was the last 
time the veteran was seen in person, The BHAP Guide indicates that 
the final visit should be the last time the veteran had in-person contact 
with any VAMC staff, but the BHAP Guide does not identify the 
different types of visits that should be counted.®® VA Centra! Office 
officials stated that a visit to an immunization clinic should be included 
as the final visit with the veteran. When VAMCs do not provide 
consistent data. VA Central Office will receive and use inconsistent 
data in preparing its trend reports, such as BHAP interim reports, 
which are intended to be used to improve suicide prevention efforts. 

• We also found instances in which BHAP templates included 

information that did not conform to the instructions in the BHAP Guide 
on how to complete the BHAP medical record reviews, 

• Last contact did not always represent the last time a VAMC 
official spoke with the veteran: The BHAP Guide instructions 
specify that the last contact recorded in the BHAP template should 
be the last recorded interaction with the veteran, which could be in 
person, through a phone call, or through email, Five of the 63 
BHAP templates we reviewed did not indicate the last time an 
official spoke directly to the veteran. One BHAP template counted 
a phone call with a veteran's spouse after the veteran’s death as 
the last contact with the veteran. The BHAP template also counted 
this phone conversation as an “in-person” interaction. The 
remaining four BHAP templates included a date for the last 
contact that was prior to the date for the veteran’s final in-person 
visit at the VAMC. in these instances, the veterans’ in-person visit 


®®The BHAP Guide can be used as a reference when completing the BHAP template 
because the BHAP Guide contains specific time frames for some of the fields, several of 
which are not outlined in the BHAP template, 

®®The BHAP Guide states that the final visit could include a mental health or a dental visit, 
but does not specify if a visit to an immunization clinic should be counted. The BHAP 
template includes a field for type of visit. One option as an answer for this field is “other," 
and the type of visit can be included in a text box in the template. 
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should have been counted as the last contact. From this flawed 
information. VA would not be able to determine reliable trends for 
the amount of time between the last contact with the veteran and 
the veteran's date of death for reports that it prepares, such as the 
BHAP interim report. 

• Suicide prevention coordinator contact and referral not within 
BHAP time period: The BHAP Guide specifies that VAMCs 
should indicate in the BHAP template whether there was a suicide 
prevention coordinator contact or referral made within 3 months 
prior to the veteran’s date of death, in 3 of the 63 cases we 
reviewed, we found that the suicide prevention coordinators 
checked the box indicating that they saw the veteran or had a 
referral within 3 months of the veteran's death. However, in each 
of these cases we found that the contact was made more than 
3 months prior to the veteran's death, so it should not have been 
counted. A suicide prevention coordinator from one VAMC said 
she was unaware of the time period requirement and a suicide 
prevention coordinator at another VAMC stated that time frames 
should be added to the BHAP template, rather than just included 
in the BHAP Guide, The BHAP interim reports include the number 
of veterans that had a suicide prevention coordinator contact or 
referral, and by including information on contacts or referrals that 
are outside the BHAP Guide time frame, these reports may be at 
risk of misreporting trends in this area. 

See figure 4, which provides an excerpt of the fields from the BHAP 

template in which VAMCs provided inconsistent data, 
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Figure 4: Excerpts of the Department of Veterans Affairs’ (VA) Behavioral Health Autopsy Program (BHAP) Template in Which 
Seiected VA Medical Centers Submitted Inconsistent Data 



HgaUh C are 

Mujtiple F aiiufes to Sliow : diecJ< H 'vas' ■ 

Number of Inpatient VA MH Beii Days in Last 30 da»s? [ ' i 
Numbw of OiitfiatJM VA MH vistts in last 30 davs' ^ ! 
Used Vet Center Services in Past Year? Select., 

Non-VA Care in Past Year? Se le ct- 


Type of Final Walt : Select... 


Was Hie.fitw! V.I.siti Inpationl . , Outpatient 

if Not Foiiowgd bv Mental Health, was there a Pavchlatrtst Refwral? Select.^ 


M en tal Status Exam at Last MH Visit : ■ 

Do you wish to Entw Comments yiChedt to do so,) '" 
Dot* of Last Contact: T I 


Type of Last Contact ; in-person i' .Phaie ■’ , emaS. or text.ordis^^ 


The final visit should include the last time the 
veteran had in-person contact with VA staff. 


o The date of last contact should be the last 
recorded personal interaction with the 
veteran, including in-person visits, phone 
calls, or contact via email. 


8PC Contact/Refyrral ? Check If •W -CT- HwnWess Pfevwition Contact ? S^get . 

^ HomaUssatTOD ? Sflect-,. 


Source. GAO analyain ofVA bocumBnls. ! GAO'1S-55 


^ The BHAP Guide indicates that this field 
should include referrals within 3 months of 
the date of death; however, this time frame is 
not specified in the BHAP template. 


VA policy and guidance states that the BHAP template should be 
completed for all suicides known to the facility, but at the five VAMCs we 
visited, these data were not always being reported, However, the policy 


®^VA Central Office has provided policy on the BHAP template through a memorandum 
and has also provided suicide prevention coordinators with a BHAP Guide, which explains 
how to fill out the BHAP template. 


GAO-15-S5 VA Psychiatric Medications and Suicide Data 




117 


and Instructions do not explicitly state that veterans not being seen by VA 
should be included, and in the absence of this declaration, some VAMCs 
interpreted the instructions to mean that only veterans being seen by VA 
should be included in the data submitted. Therefore, two VAMCs have 
submitted data only for veterans being treated by VA, while the others 
include data on all known veteran suicides — whether they have been 
treated by VA or not. This further adds to the inconsistencies in the 
information that VAMCs submit on the BHAP templates, VA Central 
Office officials told us that BHAP templates should be completed for both 
veterans utilizing VA health care services, as well as those veterans not 
being seen in the VA, and that this requirement has been discussed at 
training sessions and during conference calls with suicide prevention 
coordinators. For example, during a suicide prevention conference in 
November 2013, a VA Central Office official informed participants that the 
BHAP template should be completed for all suicides reported through 
SPAN, which VA Central Office officials previously told us includes 
veterans that were not receiving VA care. The inconsistency in VAMC 
officials’ understanding of which veterans should have a completed BHAP 
template results in inconsistent data being reported to VA Central Office. 
While VA was in the process of updating its suicide prevention 
coordinator manual, we brought this issue to VA’s attention. In August 
2014, VA made modifications to the manual that indicated that VA is 
changing its policy — now requiring that the BHAP template should be 
completed only for veterans receiving VA services, However, the 
guidance continues to be unclear on whether suicide prevention 
coordinators should complete BHAP templates for veterans not receiving 
VA careA® 


VAMCs, ViSNs, and VA We found that BHAP templates are not being reviewed by VA officials at 
Cantral Office Do Not ^my level for accuracy, completeness, and consistency. Therefore, our 

Review Suicide Data findings at five VAMCs could be symptomatic nationwide and other 

VAMCs may also be submitting incomplete, inaccurate, and inconsistent 
suicide-related information and VA may not be getting the data it needs 
across the Department to make appropriate resource decisions and 
develop new policy. VA policy states that it is the VISN’s and VAMC’s 
decision whether to conduct reviews of BHAP data prior to submission to 


its comments on a draft of this report, VA stated that in September 2014 it provided 
guidance to VAMCs to ojmplete BHAP templates for veterans not receiving VA services. 
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VA Centra! Office. With few exceptions, VAMCs and ViSNs we visited 
generally do not conduct data checks on the information submitted in the 
BHAP templates. Additionally, VA Central Office does not review the 
information for accuracy and completeness in the BHAP templates it 
receives. This approach is inconsistent with interna! control standards for 
the federal government, which state that agencies should have controls 
over information processes, including procedures and standards to 
ensure the completeness and accuracy of processed data,®^ 

Officials at one VAMC told us that VAMC staff compare the BHAP data 
and the veteran’s medical record prior to submitting the BHAP template to 
VA Central Office to ensure accuracy. In response to our review, another 
VAMC implemented a procedure to check the accuracy and 
completeness of their BHAP templates prior to submission. The 
procedure at this VAMC requires the suicide prevention coordinator and 
case manager to independently complete the BHAP template and 
compare their responses. The BHAP templates are then reviewed by the 
Assistant Mental Health Clinic Director prior to submission. 

We also found that VA lacks sufficient controls to ensure the quality of the 
existing BHAP data. For example, VA Central Office officials said there 
are no automated data checks to ensure the accuracy of data it uses for 
the BHAP interim report, such as checking to ensure that the date of last 
contact with the veteran that is recorded in the BHAP template is not after 
the veteran’s date of death. Although officials removed apparent 
duplicates in submitted BHAP templates by matching the veteran’s name 
and social security number while compiling the data for the most recent 
BHAP interim report, they do not conduct data checks to help identify 
some of the incomplete or inaccurate data we found in our review, 


Conclusions 


Given the negative effects of MOD, it is Important to provide timely, 
evidence-based treatment for veterans with MDD, and VA’s ability to 
monitor these veterans is critical to ensuring positive outcomes. However, 
our findings demonstrate that VA may not be fully aware of the population 
of veterans with MDD due to a lack of coding precision by clinicians. This 
can limit VA’s ability to assess the Department’s performance in treating 


^^See GAO, Standards for Internal Control in the Federal Government, 
GAO/AIMD-00-21.3.1 (Washington, D.C,: November 1999). 
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veterans as recommended in the MDD CPG and in measuring health 
outcomes for veterans. Additionally, VA does not have mechanisms in 
place to ensure that the Department is able to identify deviations from 
CPG-recommended care and remedy those that could impede veterans' 
recovery. Even if VA did have mechanisms in place, the coding 
discrepancies we identified would limit VA’s ability to extract accurate 
data on ait veterans diagnosed with MDD, therefore hindering VA’s ability 
to determine the extent to which veterans are receiving care consistent 
with the CPG recommendations for MDD. The CPG recommendations 
are meant to improve veteran outcomes by providing maximum relief from 
the debilitating symptoms of MDD. and VA cannot ensure that the care 
veterans receive is consistent with those recommendations. 

The existence of incomplete, inaccurate, and inconsistent information 
submitted through VA’s BHAP templates limits the Department’s ability to 
accurately evaluate its suicide prevention efforts and identify trends in 
veteran suicides through the BHAP initiative. Specifically, data drawn 
from incomplete, inaccurate, and inconsistent BHAP templates limit the 
Department’s opportunities to learn from past veteran suicides and 
ultimately diminish efforts to improve its suicide prevention activities. 
VAMCs, VISNs, and VA Central Office generally lack a process to ensure 
that the data that are submitted and used by VA Central Office to identify 
trends in veteran suicides are complete, accurate, and consistent, 
Checking and verifying the data submitted to VA Central Office would 
help ensure that changes made to suicide prevention efforts by VAMCs, 
VISNs, and VA are based on actual trends in veteran suicides, Without 
clear VA Central Office instructions to guide how VAMCs and VISNs 
should complete BHAP templates and report suicide data, the validity of 
suicide data and the effectiveness of VA’s actions will be hampered. 


Recommendations for 
Executive Action 


identify the extent to which there is imprecise diagnostic coding of 
MDD by further examining encounters with a diagnostic code of 
depression not otherwise specified, which could be incorporated into 
VAMCs’ ongoing review of diagnostic coding accuracy, and 


We recommend that the Secretary of Veterans Affairs direct the Under 
Secretary for Health to take the following six actions: 

To more accurately estimate the prevalence of MDD and identify enrolled 
veterans with MDD, VA should 
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• determine and address the factor(s) contributing to the imprecise 
coding based on the results of those examinations. For example, 
feedback and additional training could be provided to clinicians 
regarding the importance of diagnostic code accuracy, or VA’s 
medical record could be enhanced to facilitate the selection of a more 
accurate diagnostic code. 

To ensure that veterans are receiving care in accordance with the MDD 

CPG, VA should 

• implement processes to review data on veterans with MDD prescribed 
antidepressants to evaluate the levei of risk of any deviations from 
recommended care and remedy those that could impede veterans’ 
recovery. 

To improve VA’s efforts to inform its suicide prevention activities, VA 

should 

• ensure that VAMCs have a process in place to review data on veteran 
suicides for completeness, accuracy, and consistency before the data 
are submitted to VA Central Office, 

• clarify guidance on how to complete BHAP templates to ensure that 
VAMCs are submitting consistent data on veteran suicides, and 

• implement processes to review data on veteran suicides submitted by 
VAMCs for accuracy and completeness, 


AaenCV Comments We provided a draft of this report to VA for comment. In its written 
® ^ comments, reproduced in appendix IV, VA generally agreed with our 

conclusions and concurred with our recommendations, In addition, VA 
provided information on its plans for implementing each recommendation, 
with estimated completion dates in calendar year 2015. 


As agreed with your office, unless you publicly announce the contents of 
this report earlier, we plan no further distribution until 30 days from the 
report’s date. At that time, we will send copies of this report to the 
appropriate congressional committees; the Secretary of Veterans Affairs: 
the VA Under Secretary for Health; and other interested parties, in 
addition, the report will be available at no charge on the GAO website at 
http;//www. gao.gov. 
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If you or your staff have any questions, please contact me at (202) 512- 
71 14 or wllliamsonr@gao.gov. Contact points for our Offices of 
Congressional Relations and Public Affairs may be found on the last page 
of this report. Major contributors to this report are listed in appendix V. 

Sincerely yours, 



Randall B. Williamson 
Director. Health Care 
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Appendix I: Scope and Methodology 


Characteristics of 
Veterans Diagnosed 
with Major 
Depressive Disorder 
(MDD) 


To describe the characteristics of veterans diagnosed with MDD from 
fiscal years 2009 through 2013, we analyzed Department of Veterans 
Affairs (VA) and Department of Defense (DOD) data, (See table 3.) These 
data included information on veterans’ demographic characteristics as 
well as clinical infomiation on health care services and medications 
provided through VAJ Veterans were classified as having a diagnosis of 
MDD if. in at least one fiscal year included in our review, they had two or 
more outpatient encounters or at least one inpatient hospital stay with a 
diagnosis of MDD. ^ 


'in general, veterans must enroll in VA health care to receive VA's medical benefits 
package, a set of services that includes hospital and outpatient services and prescription 
drugs. Veterans w/ho served in the active military and who were discharged or released 
under conditions other than dishonorable may be eligible for VA health care. Some non- 
veterans may also be eligible for VA health care, such as spouses and children of 
veterans who have been rated permanently and totally disabled for a service-connected 
disability. We exduded non-veterans from our analysis. 

^We identified this approach through discussions with VA clinical and data experts. This 
approach is consistent with previous GAO work. See, for example, GAO, VA Mental 
Health: Number of Veterans Receiving Care, Barriers Faced, and Efforts to Increase 
Access, GAO-12-12 (Washington. D.C.: Oct. 14, 2011). 
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Appendix t: Scope and Methodology 

Table 3: Description of Department of Veterans Affeirs and Deparbnent of Defense Data Files Used to Examine 

Characteristics of Veterans with Major Depressive Disorder for Fiscal Years 2009 through 201 3 

Data files 

Description 

Demographic flies 

includes information extracted from the Department of Veterans Affairs (VA) Corporate 
Data Warehouse on veterans' age; date of death, if applicable; sex; race; and ethnicity. 

The Corporate Data Warehouse is a national data repository comprising data from 
several VA clinical and administrative systems. 

Information on whether veterans served during recent conflicts in Iraq and Afghanistan 
was obtained from a Department of Defense roster. 

fvledical SAS Inpatient Datasets, Acute 
Care Dataset 

Includes information on acute care inpatient stays at VA medicai centers (VAMC) that last 
at least 24 hours, induding admission and discharge date as well as diagnosis codes. 

This dataset comprises information on inpatient care that is entered into veterans' 
electronic medicai records by staff at VAMCs. 

Fee basts inpatient files® 

Includes infonnation on certain acute care inpatient stays at non-VAMCs, including 
admission and discharge dates as well as diagnostic codes. VA pays for these stays at 
non-VAMCs when VA cannot offer needed care, when a non-VA provider would be 
economical, or on an emergency basis when travel to a VA facility is medically infeasible. 
The fee basis inpatient files for each fiscal year are limited to information on inpatient 
stays at non-VAMCs that were paid for by VA during the corresponding fiscal year. 

Outpatient encounter fifes 

Includes information on outpatient services rendered by VA providers, including the date 
of the services and diagnoses treated- This file comprises information on individual 
outpatient encounters entered into veterans' electronic medicai records by staff at VA 
medical facilities. Encounters are defined as a professional contact between a patient 
and a VA provider with responsibility for diagnosing, evaluating, and treating veterans’ 
conditions. 

Fee basis outpatient services files” 

Includes information on certain outpatient care rendered by non-VA providers, including 
the date of the visit and the reason for the visit. VA pays for these services from non-VA 
providers when VA cannot offer needed care, when a non-VA provider would be 
economical, or on an emergency basis when travel to a VA facility is medically infeasible. 
The fee basis outpatient services files for each fiscal year are limited to information on 
outpatient encounters that were paid for by VA during the corresponding fiscal year, 

Pharmacy Benefits Management 
prescription database 

Includes information on medications ordered by VA providers, including medication name 
and dosage instructions. The pharmacy database comprises information on medication 
orders, which are entered into local pharmacy databases by staff at VA medicai facilities. 


Source: GAO. I GAO-1S-55 


*The two data sets have retained the name fee basis though VA now refers to this type of care as 

non-VA medicai care. 

Specificaily, we examined the following: 

• Number of veterans diagnosed with MDD, We used a demographic 
file provided by VA to determine the number of veterans diagnosed 
with MDD. 

• Characteristics of veterans diagnosed with MDD. We used 
demographic files provided by VA and DOD to describe 
characteristics of veterans diagnosed with MDD. In particular, the 
veteran characteristics we examined included the following: 
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Appendix i: Scope and Methodology 


• Age. We created seven categories for veterans’ ages as of 
September 30, 2013 — the end of fiscai year 2013, which 
corresponds to the last date of data we included in our analysis. 
These categories are as follows: (a) 18-24, (b) 25-34, (c) 35-44, 

(d) 45-54, (e) 55-64, (f) 65-74, and (g) 75 and older, 

• Era of service. We categorized veterans as either being veterans 
of the recent conflicts in Iraq and Afghanistan — Operation Iraqi 
Freedom. Operation Enduring Freedom, and Operation New 
Dawn — or of other eras of service.^ 

• Sex. We categorized veterans as either being female or male, 

• Race and ethnicity. We created categories to describe veterans' 
race and ethnicity (Hispanic and non-Hispanic). These categories 
are consistent with the Office of Management and Budget’s 1997 
Standards for Maintaining, Collecting, and Presenting Federal 
Data on Race and Ethnicity.^ 

Extent to which veterans diagnosed with WIDD were prescribed at 
least one antidepressant. Using data from the Pharmacy Benefits 
Management database, we examined the extent to which VA 
providers prescribed at least one antidepressant for veterans 
diagnosed with MDD from fiscal years 2009 through 2013, This 
includes antidepressants prescribed to treat depression as well as 
those prescribed to treat other conditions,® 

The percentage of veterans with MDD dispensed a 12-week and a 
6-month supply of an antidepressant. Using VA data we obtained 
from the Medical SAS Inpatient Datasets, Acute Care Dataset; 
Outpatient Encounter Files; Fee Basis Outpatient and Inpatient 


®We were not able to further describe veterans by other eras of service, such as Vietnam, 
because according to a VA official, VA data on era of service are unreliable. DOD roster 
data was used to determine service in Operation Enduring Freedom, Operation Iraqi 
Freedom, and Operation New Dawn. 

'’office of Management and Budget. Provisional Guidance on the Impiementation of the 
1997 Standards for Federal Data on Race and Ethnicity (Washington, D.C.: Dec. 15, 
2000 ). 

^Antidepressants, like other types of medications, may be used for off*iabel uses— -that is, 
for a condition or patient population for which the driig has not been approved or in a 
manner that is inconsistent with information found on the approved drug label. For 
example, certain antidepressants may be used to treat anxiety and fibromyalgia. See K.J. 
Stone. A.J. Viera, and C.L. Parman, “Off-Label Applications for SSRis" American Family 
Physician, vol. 68, no. 3 (2003). 
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Appendix {: Scope and Metfiodoic^y 


Services Files; and Pharmacy Benefits Management Database, we 
calculated the percentage of veterans with MDD dispensed a 1 2*week 
and a 6-month supply of an antidepressant according to statisticai 
programming logic provided by VA.® These measures are intended to 
assess the effectiveness of antidepressant medication management 
and are based on performance measures developed by the National 
Committee for Quality Assurance/ In addition, these measures are 
consistent with the VA/DOD Cfinical Practice Guideline for 
Management of Major Depressive Disorder, which indicates that 
continued antidepressant treatment, after acute depressive symptoms 
have resolved, decreases the incidence of relapse of MDD.® 

We selected six VA medical centers (VAMC) at the following locations to 
visit: Canandaigua, New York; Gainesville, Florida; Iowa City, Iowa; 
Philadelphia, Pennsylvania; Phoenix, Arizona: and Reno, Nevada.® These 
VAMCs represent different facility complexity groups, serve populations of 
veterans that differ in terms of the extent of use of mental health services, 
and are located in different Veterans integrated Service Networks (VISN), 
or regional networks of care.’° To gather additional perspectives, for each 
VAMC we visited, we selected one associated community-based 
outpatient clinic to visit, in particular, we visited community-based 
outpatient clinics in the following locations; Cedar Rapids, Iowa; Globe, 
Arizona; Gloucester, New Jersey; Lecanto, Florida; Fallon, Nevada; and 
Rochester, New York. (See table 4.) As part of our site visits, we 


®VA’s approach to measuring its performance on these measures uses data regarding 
care rendered at VA facilities only; however, in order to account for care rendered by non- 
VA providers but paid for by VA. we incorporated fee basis data. 

’’The National Committee for Quality Assurance's 2013 antidepressant medication 
management quality measures are known as Effective Acute Phase Treatment and 
Effective Continuation Phase Treatment. 

®Evidence-Based Practice Work Group, VA/DOD Clinical Practice Guideline for 
Management of Major Depressive DisordertyJashmgton, D.C.: May 2009). 

®!n contrast to the other site visits, which were completed in person, we completed the site 
visits to the VAMCs located in Gainesville, Florida, and Reno, Nevada, virtually through 
telephone interviews. 

’°VA assigns each VAMC a complexity score between 1 and 3, with level 1 being the 
most complex, using a facility complexity model. Level 1 is broken down further into la, 

1 b, and 1c. That model uses multiple variables to measure facility complexity arrayed 
along four categories, namely patient population served, clinical services offered, 
education and research complexity, and administrative complexity. Each VAMC is 
assigned to a single ViSN. 
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reviewed a nongeneralizeable sample of five medical records for each of 
these six VAMCs for a total of 30 veterans. ” We reviewed these medical 
records to determine if the diagnostic code entered for ail encounters — 
starting with the initial encounter in 2012 when the veteran was 
diagnosed vwth MDD and prescribed an antidepressant — ^was consistent 
with a diagnosis of MDD. 


Table 4: Characteristics of Veterans Affairs Medical Centers (VAMC) and Community-Based Outpatient Clinics Selected for 
GAO's Review 

VAMC location 

Facility 
complexity 
group, 2011 

Percentage of veterans 
diat used mental health 
services, 2012 
(above or below average) 

Veterans Integrated 
Service Network 
(VISN) 

Community-based 
outpatient clinic 
location 

Canandaigua. New York 

3 

24.6 (above) 

2 

Rochester, New York 

Gainesville, Florida® 

la 

22.2 (below) 

8 

Lecanto, Florida® 

iowa City, Iowa 

1c 

16.7 (below) 

23 

Cedar Rapids, iowa 

Philadelphia, Pennsylvania 

1b 

28.3 (above) 

4 

Gloucester, New Jersey 

Phoenix, Arizona 

1c 

24.3 (above) 

18 

Globe, Arizona 

Reno, Nevada* 

2 

22.4 (below) 

21 

Fallon. Nevada" 


Sourcs: GAO a'latysisofVAcJala. [ GAO-15-55 


Note; The Department of Veterans Affairs (VA) assigns each VAMC a. complexity score between 1 
and 3. with level 1 being the most complex, using a facility complexity model. Level 1 is broken down 
further Into la. 1b. and 1c. That model uses multiple variables to measure facility complexity arrayed 
along four categories, namely patient population served, clinical services offered, education and 
research complexity, and administrative complexity. Each VAMC Is assigned to a single regional 
network of care, called a VISN. 

*ln contrast to the other site visits, which were conducted in person, we conducted a virtual site visit 
via telephone interviews to these locations. 

To select medical records for review, we completed the following steps: 

• Randomly generated a list of individuals with a new prescription for an 
antidepressant in calendar year 2012, 

• Selected the first five individuals in the list that met the following 
inclusion criteria; 

• Veteran status. 

. Had a diagnosis of MDD in calendar year 2012, For the purposes 
of medical record reviews, we classified a veteran as having a 


’’"'We use the phrase medical records to refer to electronic medical records. 
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diagnosis of MDD if, based on how the veteran's patient care 
encounters were coded or on the narrative contained in ciinicat 
notes in the veteran’s medical record, the veteran had (a) at least 
two outpatient encounters with a diagnosis of MDD, or (b) at least 
one inpatient stay with a diagnosis of MDDJ^ 

• Had a new treatment episode of antidepressants in calendar year 
2012. New treatment episodes were defined as an initiation of 
antidepressant treatment following a period during which the 
veteran was either (1) not prescribed an antidepressant or (2) 
noncompiiant with and had not picked up prescriptions for a 
previously prescribed antidepressant. 

To ensure the reliability of the data we analyzed, we interviewed VA 
Central Office officials, reviewed relevant documentation and veterans’ 
medical records, and conducted electronic testing to identify missing data 
and obvious errors. On the basis of these activities, we determined that 
the data we analyzed were sufficiently reliable for our purposes. However, 
as discussed in the report, we described limitations of the data due to the 
coding discrepancies we found. 


VA’s Oversight of the 
Extent to Which 
Veterans with MDD 
Prescribed 
Antidepressants Are 
Receiving Care As 
Recommended in the 
CPG 


To examine the extent to which VAMCs are providing care to veterans 
with MDD who are prescribed antidepressants as recommended in the 
CPG, we reviewed relevant VA policy documents. On the basis of that 
review, we found that VA policy requires all care sites, VAMCs, and 
community-based outpatient clinics to provide evidence-based 
antidepressant treatment when indicated for depression and that such 
care must be consistent with current VA clinical practice guidelines. The 
relevant VA clinical practice guideline, the VA/DOD Clinical Practice 
Guideline for Management of Major Depressive Disorder, provides 
evidence-based recommendations for providers on how to monitor 
veterans prescribed antidepressants; these recommendations are based 
on a review of depression research outcomes. These recommendations 
are based on available research at the time of publication of the guideline 
and are intended to provide information to assist providers in treatment 


^^This approach for dassifyjng veterans as having MDD is consistent with the approach 
used for the purposes of our data analysis, which we identified in discussions with VA. 

’’^Veterans Health Administration Handbook 1 160.01 , Uniform Mental Health Services in 
VA Medical Centers and Clinics (Sept. 1 1 , 2008). 
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decision-making.’^ From the guideline's recommendations related to 
monitoring veterans prescribed antidepressants, we judgmentally 
selected three recommendations for inclusion in our review. In particular, 
we selected recommendations that (1) had among the highest strength of 
research evidence, <2) were sufficiently specific to enable us to determine 
the extent to which VA providers were following the recommendation, and 
(3) would not require clinical judgment to determine the extent to which 
VA providers were following the recommendation. The following 
recommendations were included in our review; 

. To enhance antidepressant treatment, veterans should be educated 
on when to take the medication, possible side effects, risks, and the 
expected duration of treatment, among other things; 

• Standardized assessments of depressive symptoms, such as the 
Patient Health Questionnaire-9, should be used to monitor treatment 
response at 4-6 weeks after initiation of treatment, after each change 
in treatment, and periodically thereafter until full remission is 
achieved; and 

• A plan should be developed that addresses the duration of 
antidepressant treatment, among other things. 

After selecting these recommendations for our review, we examined the 
extent to which veterans were receiving care consistent with these CPG 
recommendations at the six VAMCs we visited.’® To do this, we 
interviewed VAMC clinicians to determine whether and how they were 
following these recommendations. At each VAMC, officials interviewed 
Included members of the executive leadership team, primary care and 
mental health providers, and pharmacists.’® 


’■’Although the guideline is not intended to define a standard of care, through policy, VA 
has set an expectation that providers follow/ the guideline's recommendations. 

’®For the purposes of this report, we refer to VAMCs to include community-based 
outpatient clinics. 

’®We also interviewed primary care and mental health providers at each community-based 
outpatient clinic. 
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Additionally, as part of our examination of the extent to which VAMCs are 
providing care consistent with the selected guideline recommendations, 
we reviewed the sample of five veterans’ medical records per VAMC used 
as part of our review of MDD coding. For each medical record, we 
reviewed documentation contained in the selected veterans’ medical 
records to assess the extent to which the antidepressant treatment- 
related care VA providers rendered was consistent with the selected GPG 
recommendations included in our review. Our review commenced with 
the encounter during which a VA clinician ordered an antidepressant to 
treat depressive symptoms. Our review ended after five foilow-up 
encounters wth a VA clinician, or sooner if the veteran did not have five 
follow-up encounters. Our review was limited to encounters during which 
the antidepressant treatment was reviewed, including encounters during 
which side effects and treatment effect were assessed, but no change 
was made to medication orders. We did not include, for example, an 
encounter with an orthopedist during which the fact that the veteran had 
been prescribed an antidepressant was simply noted. We provided the 
VAMCs with the instances where we found the medical record 
documentation was not consistent with the selected CPG 
recommendations. The VAMCs confirmed our answers or provided 
additional support if they believed the care was consistent with the CPG. 

To examine VA’s oversight of the care VAMCs provide to veterans with 
MDD who are prescribed an antidepressant, we reviewed VA’s oversight 
of the Uniform Mental Health Services in VA Medical Centers and Clinics 
handbook and CPG requirements and evaluated whether this oversight 
provides VA with adequate information to identify nonconformance with 
recommended practices, assess the risk of any nonconformance, and 
address nonconformance, as appropriate. ■*'' As part of this review, we 
reviewed VA's oversight in the context of federal standards for internal 
control for risk assessment.’® The internal control for risk assessment 
refers to an agency’s ability to comprehensively identify risks, assess the 
possible effect, if any, and determine what actions should be taken to 
mitigate significant risks. 


’^Veterans Health Administration Handbook 1 160.01 , Uniform Mental Health Services in 
VA Medical Centers and Clinics {Sept, 1 1 , 2008). 

’®See GAO, StandaMs for Internal Control in the Federal Government, 
GAO/AiMD-00-21.3.1 (Washington, D.C.: November 1999) and GAO, Internal Control 
Management and Evaluation Tool, GAO-01-10Q8G (Washington, D.C.; August 2001), 
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We then interviewed officials from VA Centra! Office, including officials 
from the Office of Mental Health Services (OMHS), the Office of Mentai 
Health Operations, and the Office of Analytics and Business inteiiigence; 
and the six VISNs that oversee the VAMCs we visited who are 
responsible for overseeing compliance with VA’s requirements, including 
VA’s requirement that all VA facilities provide evidence-based 
antidepressant treatment when indicated for depression and that such 
care be consistent with current VA clinical practice guidelines. Through 
our interviews, we obtained information on the oversight activities 
conducted by VA Central Office and the extent to which VA Central Office 
followed up with VAMCs to ensure that they corrected problems identified 
through these oversight activities. In addition, we obtained and reviewed 
relevant documents regarding VA oversight, including internal reports and 
VAMCs' plans to correct problems identified through oversight activities. 


To analyze the information VA requires VAMCs to collect on veteran 
suicides, we first reviewed VA policies, guidance, and documents related 
to VA's suicide prevention efforts to identify the mechanisms by which VA 
collects veteran suicide data from VAMCs, We also interviewed VA 
Centra! Office and other officials responsible for VA's suicide prevention 
program, including officials from OMHS and the Center of Excellence for 
Suicide Prevention. We also interviewed VAMC officials and relevant staff 
of the six ViSNs for the sites we visited to obtain information on suicide 
prevention initiatives. 

Next, through the site visits to six VAMCs, we obtained documents and 
interviewed officials regarding the collection of veteran suicide data, We 
obtained all completed templates from the Behavioral Health Autopsy 
Program (BHAP) related to VA’s collection of data on veterans that died 
by suicide as of the time of our site visit or at the time we requested the 
documents for virtual site visits.’® One VAMC had not completed any of 
these BHAP documents because they had not had a veteran die by 
suicide since the beginning of the program. Therefore, our analysis 
includes a review of documents from five of the six VAMCs we visited. 
Through review of the documents, we noted any fields missing data, such 
as a field that requires a yes or no answer but neither answer is provided. 


information VA 
Requires VAMCs to 
Collect on Veteran 
Suicides 


’®One template had been completed as of the time of our site visit, but had not been 
received by VA Central Office; therefore, we did not include this template in our review. 
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Additionally, using professional Judgment, we identified fields in the 
documents to review based on whether the field related to aspects of VA 
treatment — including treatment for mental health conditions — and the 
date of the veteran’s death. We identified these fields because they did 
not require clinic^i judgment to assess. Using the parameters in the 
corresponding guide for filling out these documents, including time 
frames, we compared these fields to information included in the veteran’s 
medical record and noted differences between our answers and the 
answers provided by the VAMCs in the documents. 

To ensure that we received the final, submitted versions, we also 
requested these documents from VA Central Office for each of the five 
VAMCs. We compared these documents to the documents we received 
from the VAMCs. We used the documents from the VAMCs as the 
starting point; therefore, we only analyzed the templates for veterans 
identified by the VAMCs.^' During the course of our review we learned 
that the template for these documents had changed over time. If 
additional fields were included in the templates obtained from VA Central 
Office, but were not originally included in the templates obtained from the 
VAMCs. we did not review these fields. We generally used the answer 
from the document obtained from VA Central Office, which is the final 
submitted version, unless a field originally had an answer in the template 
from the VAMC, but was blank or not answered in the template from VA 
Central Office, in those cases, we used the answer from the VAMC 
document. 

We provided the VAMCs with the fields where the answers in the VAMC’s 
documents did not match our answers based on our review of the medical 
record. The VAMCs confirmed our answers or provided additional support 
for their original answer. Results from our review of veteran suicide data 
can be generalized to the VAMCs we visited, but cannot be generalized 
to other VAMCs. 


^^Aspects of treatment paid for by VA. but rendered by non-VA providers (non-VA care) 
were not included in the scope of this review. 

^''We received additional templates from VA Centra! Office, but these were not analyzed 
because the VAMC had not provided us with templates for these veterans. 
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We conducted this performance audit from November 2013 to November 
2014 in accordance with generally accepted government auditing 
standards. Those standards require that we plan and perform the audit to 
obtain sufficient, appropriate evidence to provide a reasonable basis for 
our findings and conclusions based on our audit objectives. We believe 
that the evidence obtained provides a reasonable basis for our findings 
and conclusions based on our audit objectives. 


Page 50 


GAO-1S-55 VA Psychiatric Medications and Suicide Data 



133 


Appendix II: Department of Veterans Affairs 
Medical Centers’ Tracking of Veterans at 
High Risk for Suicide 


The Department of Veterans Affairs’ (VA) Uniform Mental Health Services 
in VA Medical Centers and Clinics handbook (Handbook) requires VA 
medical centers (VAMC) to have a suicide prevention coordinator whose 
responsibilities include establishing and maintaining a list of veterans 
assessed to be at high risk for suicide and monitoring these veterans. ’ 
The Handbook also requires suicide prevention coordinators to ensure 
that providers follow up on missed appointments for high-risk veterans to 
ensure patient safety and in order to initiate probiem-solving about any 
tensions or difficulties in the veteran’s ongoing care. 

Whether a veteran is determined to be at high risk for suicide is based on 
clinical judgment made after an evaluation of risk factors — such as history 
of past suicide attempts or recent discharge from an inpatient mental 
health unit — protective factors — such as positive soda! support, positive 
coping skills, and positive therapeutic relationships — and the presence or 
absence of warning signs. Indicators that a veteran is at high risk for 
suicide include a current verified report or witnessed suicide attempt: 
identification of current serious suicidal ideation that requires an 
immediate change in the treatment plan, such as hospitalization; and the 
presence of any of the following warning signs: threatening to hurt or plan 
to kill oneself; looking for specific ways to kill oneself and seeking access 
to such means, such as pills or weapons; and talking or writing about 
death, dying, or suicide when these actions are out of the ordinary for the 
person. 

The Handbook requires each VAMC to have a process for establishing a 
patient record flag to help ensure that veterans determined to be at high 
risk for suicide are provided with follow up for all missed mental health 
and substance abuse appointments. The primary purpose of the patient 
record flag is to communicate to staff that a veteran is at high risk for 
suicide and VA policy states that the presence of a flag should be 
considered when making treatment decisions, Suicide prevention 
coordinators are responsible for assessing, in conjunction with the 
treating clinician, the risk of suicide in individual veterans, ensuring these 
veterans have a “High Risk for Suicide" Patient Record Flag on their 
medical record, and reviewing the list of high-risk veterans at least every 
90 days. 


Veterans Health Administration Handbook 1 160.01 , Uniform Mental Health Services in 
VA Medical Centers and Clinics {Sept. 1 1 , 2008), 
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We interviewed suicide prevention coordinators as part of our site visits 
with six VAMCs to obtain information on how they track veterans 
determined to be at high risk for suicide. At four of the VAMCs we visited, 
suicide prevention coordinators used an electronic spreadsheet to track 
information on these veterans. For example, the spreadsheets include 
information such as whether the veteran has a patient record flag on their 
medical record and when the flag needs to be reviewed, the date for the 
veteran’s next scheduled foilow-up appointment, whether the veteran has 
a safety plan, and the veteran's assigned psychiatrist.^ Officials from one 
VAMC told us that they maintain the list daily, adding and removing 
veterans as necessary. Officials stated that the circumstances under 
which a veteran would be removed from the spreadsheet varied, but 
veterans are generally removed because their patient record flag has 
been removed and the officials no longer consider the veteran to be at 
high risk for suicide. 

The two remaining VAMCs use other mechanisms to track veterans at 
high risk for suicide. Officials from one VAMC told us that they use the 
Suicide Prevention Application Network (SPAN) to query high-risk 
patients at the VAMC. The SPAN database contains veteran information, 
demographic characteristics, and information on suicide attempts and 
completed suicides, among other things. According to officials, the 
information for each veteran in SPAN includes the date the veteran was 
assessed as being at high risk, as well as the date that the veteran needs 
to be seen for follow up. if applicable. After our site visit, officials told us 
they plan to periodically pull a list of ail veterans with an active high risk 
flag in VA’s medical record for the VAMC and cross-reference that list to 
veterans being tracked for high suicide risk by the suicide prevention 
coordinator in SPAN to ensure all high-risk veterans are tracked. Officials 
from the other VAMC told us that their case managers each have their 
own list of veterans that they track and the suicide prevention coordinator 
we spoke with stated that he does not keep a master list of all veterans 
that are at high risk for suicide.^ 


safety plan is a prioritized written list of coping strategies and sources of support, such 
as individuals or agencies the veteran can contact, for the veteran to use during or 
preceding suicidal crisis in order to help lower the veteran's imminent risk of suicidal 
behavior. According to VA Cwtral Office officials, the plan is created with clinician, 
veteran, and family interaction. 

^Officials at this VAMC told us that their case managers are responsible for monitoring 
veterans flagged as being at high risk for suicide. 
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Veterans Affairs medical centers (VAMC) collect and submit data on 
veteran suicides to the Department of Veterans Affairs (VA) Central Office 
through the Suicide Prevention Application Network (SPAN) and suicide 
behavior reports.’ VAMCs also coiiect and report data through root cause 
analyses. 2 Additionally, VA Centra! Office uses the data from SPAN to 
prepare reports that are sent to the VAMCs and Veterans Integrated 
Service Networks (VISN).® VA Central Office officials stated that they 
expect VAMCs and VISNs to use these reports and collected data to 
improve suicide prevention efforts and program evaluation. Through site 
visits at six VAMCs that we conducted as part of our review and through 
interviews with corresponding VISN officials, we identified examples of 
how some VAMCs and VISNs are utilizing veteran suicide data to 
improve their suicide prevention efforts. 

• VAMC and VISN officials have used SPAN to create initiatives based 
on trends In the data. For example, 

• Officials at one VAMC stated that they use the information 
collected in SPAN to provide data for performing statistical 
analyses on the outreach conducted, to study suicide attempts 
and completions across the VAMC catchment area, to understand 
the means by which veterans are dying by suicide, and to study 
the use of high-risk flags. 

♦ Officials at a VISN explained that through a review of the SPAN 
data about a year ago, officials learned that 60 percent of suicides 
in the VfSN were completed using a gun. After conducting 
research on the subject, the VISN began a firearm safety initiative, 
which includes notifying veterans by mail that they can receive 
four gun locks each upon request, with no questions asked. 


’span includes information on veterans, such as the number of suicide completions, the 
number of non-fatat suicide attempts, and other indicators of suicide prevention efforts. 
VAMC clinicians must complete a suicide behavior report when they iearn that a veteran 
exhibited self-harming behavior and include that report in the respective veteran’s medical 
record. 

^Root cause analyses are used to identify the factors that contributed to adverse events or 
close calls and to identify any steps VAMCs could implement to prevent similar events in 
the future. Root cause analyses are completed under certain circumstances, such as 
when the act occurs during a VAMC inpatient stay or within 72 hours of being discharged 
from inpatient care. 

VlSNs are regional networtcs of care. Each VAMC is assigned to a single ViSN. 
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• VAMC officiais have made programmatic changes to their suicide 
prevention eiforts based on trends in the suicide data they are 
collecting and reviewing. For example, 

• At one VAMC, officials told us that they reviewed suicide behavior 
reports and. as a result of trends identified in these reports, 
drafted a policy for medication restriction for veterans at risk of 
overdosing. Specifically, over a 3-year period, five or six veterans 
receiving VA care repeatedly attempted suicide by overdose, 
typically when they were intoxicated, VAMC officiais created a 
work group to draft policy that mitigates risk for medication 
overdose among high-risk veterans. At the time of our site visit, 
the group was exploring creating a patient record flag that would 
be included in the veteran's medical record for overdose risk 
indicating that medication supplies should be restricted for these 
veterans and the possibility of using automated pill dispensers to 
dispense medications to these veterans. 

• Through their work reviewing suicide-related information, the 
suicide prevention team at another VAMC identified a trend in its 
suicide data. In particular, they noted that some veterans were 
given a 90-day supply of the same medications that the veteran 
recently tried to use to overdose. The suicide prevention team 
mentioned this to a clinical pharmacist who had also noticed this 
issue. The VAMC is now trying to restrict days of supply for these 
types of veterans, but there is no forma! policy about this and no 
plans to craft such a policy. Additionally, officials from this VAMC 
stated that they have added items to the standardized suicide 
behavior report template to help them to collect additional useful 
information, such as active medications and pain score at the time 
of the last visit. 

• Officials from one VAMC stated that through a review of medical 
records and autopsy reports for veterans who died by suicide, 
they found that a vast majority of veterans who died by suicide 
were not being seen by a mental health provider. In response, 
officials provided education to primary care providers. VAMC 
officials also noticed that veterans receiving care for pain were 
dying by suicide at a high rate. As a result, the VAMC has started 
an initiative with the pain clinic, and, as part of this initiative, the 
chief of the pain management clinic consults with psychiatry on 
veterans at risk for suicide. 

• Officials at a VISN described changes made in response to the 
suicide data in fiscal year 2012, which showed that a percentage of 
veterans who completed suicide had no ongoing mental health care. 
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These veterans mainly received care from VA primary care providers. 
To address this, the VISN partnered with the Center of Excellence for 
Suicide Prevention and local university psychologists to help VA 
primary care providers at community-based outpatient clinics 
formulate mental health plans. 
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DEPAFtTMENT OF VETERANS AFFAIRS 
WASHINGTON DC 2042Q 

October 21. 2014 


Mr. Randalt B. Williamson 
Director. Health Care 
U.S. Government Accountability Office 
441 G Street. NW 
Washington, DC 20548 

Dear Mr, WiHiamson: 

The Department of Veterans Affairs (VA) has reviewed the Government 
Accountability Office's (GAO) draft report, “VA HEALTH CARE: Improvements 
Needed in Monitoring Antidepressant Use for Major Depressive Disorder and in 
Increasing Accuracy of Suicide Dafa’' {GAO-15-55). VA generaity agrees with GAO’S 
conclusions and concurs with GAO's recommendations to the Department. 

The enciosure specifically addresses GAO's recommendations and provides an 
action plan for each. VA appreciates the opportunity to comment on your draft report. 


Sincerely. 



■? <24 


Enclosure 
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Enclosure 

Dspartment of Veterans Affairs (VA) Response to 
Government Account^ility Office (GAO) Draft Report 
“VA HEALTH CARE: Impravaiwnts Needed in Monitoring Antidepressant Use for 
Major Depressive Disorder and in Accuracy of Suicide Data” 
(GAO-15-55) 

GAO Recommendation : The Secretary of Veterans Affairs direct the Urtder 
Secretary of Health to take the following six actions: 

To more accurately estimate the prevalence of MDD and Identify enrolled 
veterans with MOO, VA should 

Recommendation 1 : iderrtify the extent to which there is Imprecise diagnostic 
coding of MOD by further examining encounters with a diagnostic code of 
depression not otherwise specified, which couid bo incorporated into VAMCs' 
ongoing review of diagnostic coding accuracy. 

VA Comment : Concur. The Oepartnent of Veterans Affairs (VA) agrees that precise 
and reliable diagnoses are an important guide to treatment planning. The Veterans 
Health Administration (VHA) will examine patterns of diagnostic coding among VHA 
patients with new episodes of depression treatment by evaluating diagnosis patterns 
arKf treatment settings. This will include examination of the available data regarding 
structured assessments for depression Population Health Questionnaire (PHQ) scores 
in association with diagnostic specificity and treatment settings. For example, VA may 
expect that initial assessments performed in primary care settings are coded with less 
specificity, relative to follow-up assessments conducted in mental health clinic settings. 
Target Completion Date: January 2015. 

Recommendation 2 ; determine and address the factor(a) contributing to the 
imprecise coding based on the results of those examinations. For example, 
feedback and additional training could be provided to clinicians regarding the 
importance of diagnostic coda accuracy, or VA’s medical record couid bo 
enhanced to facilitate the selection of a more accurate diagnostic code. 

VA Comment : Concur, In addition to the analyses described above in 
Recommendation 1 , VA will conduct focused chart reviews to evaluate whether further 
information regatoing the care processes and clinical communications may help to 
explain changes in diagnostic specificity among individuals who at some point receive 
Major Depressive Disorder (MDO) diagnoses, VHA will consult with a sample of 
treatment providers in primary care and in mental health clinic settings to analyze VHA's 
understanding of diagnostic code selection and to develop steps to enhance diagnostic 
coding practices. 


In part, future actions are dependent on the findings associated with 
Recommendation 1 . However, identification and correction of factors contributing to 
impredse coding was initiated based upon the findings of the GAO review of 30 
records, informatics staff inflated a national review of the encounter forms for Mental 
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E^artment of Veterans Affairs (VA) Response to 
Government Acojurrtabiiity Office (GAO) Draft Report 
"VA HEALTH CARE: Improvements Needed In Monitoring Antidepressant Use for 
Major Depressive Disorder and In Accuracy of Suicide Data" 
(GAO-15'55) 

Health appoinftnents and idenfifi«} the software mapping error in the diagnosis search 
feature that was referenced in the r^jort. Steps have been taken to correct this 
mapping error, and VHA expects that this fix will be deployed to the field in November 
2014. Additirmally, in September 2014 both Mental Health and Health Information 
Management Senrice staff in tt>e field were notified via email distribution and conference 
calls regarding this software error, if additional coding reviews reveal further coding 
Inaccuracies, a s^an will be developed to determine and address the factors contributing 
to ccxlif^ variance from Bie diagnosis supported in the documentation of the progress 
note. Target Completion Date: Mardi2015. 

To ensure that veterans are receiving care In accordance widi the MOO CPG, VA 
should 

Recommendation 3 : implement processes to review data on veterans wiUi MOD 
prescribed anddepressants to evaluate the level of risk of any deviations from 
recommended care and remedy those that could Impede veterans recovery. 

VA Comment : Concur. Using the available measures of antidepressant treatment 
practices (e.g., the Healthcare Effectiveness Data and Information Set) measure of 
adequate antidepressant continuation following a new antidepressant start. VMA will 
examine associations between treatment practices and indicators of Veteran recovery 
and/or adverse outcomes. This will include assessing change.8 In PHQ scores, as 
available, as well as associations with potential adverse outcomes such as inpatient 
psychiatric admissions. VA notes that such analyses are complicated by potential 
confounds (e.g., greater treatment receipt among patients with greater severity, with 
severity also associated with greater likelihood of negative outcomes). Future actions 
will be informed by the aforementioned analysis. Target Completion Date: March 2016. 

To Improve VA's efforts to inform its suicide prevention activities, VA should 

Recommendation 4 : ensure that VAMCs have a process in place to review data 
on veteran suicides for completeness, accuracy, and consistency before the data 
are submitted to VA Central Office. 

VA Comment : Concur, This is data that frequently changes as more data become 
available The infomiation Is all submitted to the Center of Excellence for Suicide 
Prevention (CoE) as it becomes available and there is the ability to change the data 
once it is submitted. Delaying the submission until it is complete would result In several 
non-entries. "Oierefore. sites are encouraged to submit what they have when it is 
available, in the fature, the CoE will ask for verification of review by facility leadership of 
all submissions during the previous 6 months prior to analyzing or rolling up the data, 
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Appendix IV: Comments from the Deparhnent 
of Veterans Affairs 


Enclosure 

D^ar^Ttent of Veterans Affairs (VA) Response to 
Government Accountability Office (GAO) Draft Report 
"VA HEALTH CAFtE: Improvements Needed in Monitoring Antidepressant Use for 
M^r Depressive Disorder and in Accuracy of Suicide Data” 
(GAO-15-56) 

The CoE will create an initial box on the diait review form that will acknowledge this has 
been completed at the tediity level. Target Completion Date: June2015. 
Recommeridation S : clarify guidance on how to complete BHAP templates to 
ensure that VAMCs are submitting consistent data on veteran suicides. 

VA Comment : Concur. New guidance has been incorporated into the Suicide 
Prevention Coordinator (SPC) Guidebook and it was redistributed to the field, in 
addition, a Frequently Asked Question sheet was developed and sent to the field in 
September 2014 (Attachment A), and CoE staff will be present on monthly SPC cails to 
respond to any questions and needs. 

Rocommondation 6 : implement processes to review data on veteran suicides 
submitted by VAMCs for accuracy and compieteness. 

VA Comment : Concur, A software program is being written to compare Chart Reviews 
from tho Behavioral Health Autopsy Program to the Suicide Prevention Access Network 
data on a monthly basis. If there are differences in who submitted them, the information 
will be pulled and returned to the SPC for clariftoation. In addition, all submissions wit! 
be revie'.ved for completeness 3 montes after submission and returned for darificatton, if 
needed, prior to any analysis or roll up of the data. This will be completed prior to 
facility leadership review Target Compietion Date; December 2015. 
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STRENGTHENING DEPARTMENT OF HOMELAND SECURITY 

Chairman Johnson, Ranking Member Carper, and distinguished Members of the Committee: 

Thank you for the opportunity to submit this Statement for the Record regarding the 2015 Government 
Accountability Office (GAO) High Risk List. Secretary Johnson and 1 appreciate this Committee’s 
interest in this important issue. 

We are grateful to GAO for the valuable oversight they exercise. It is my firmly-held belief that good 
oversight not only delivers accountability critical to good government, but that it also drives innovation. 
We have benefited greatly from GAO’s hard work to help us improve, and continue to do so as we work 
regularly with GAO to address the Department of Homeland Security’s (DHS) presence on the High 
Risk List, 

When I became the Deputy Secretary of DHS in late December 2013, the first action I took was to 
schedule a meeting with Comptroller General Dodaro. I committed early on to engage with GAO 
frequently, with the intention of not only getting off the GAO High Risk List but also to set the standard 
within the Federal Government for how to engage with and learn from GAO and its dedicated team of 
experts. I am proud of the progress we have made, demonstrating significant improvements in several 
High Risk List areas, and also seiving as a model for collaboration and partnership with GAO. We will 
continue to .seek out GAO and work together to improve this Department. 

Strengthening Department of Homeland Security Management Functions 

Upon its creation in 2003, DHS was immediately placed on the GAO High Risk List because of the 
challenge of bringing together 22 disparate federal entities and the very serious consequences of another 
attack on our Nation. In each subsequent GAO High Risk List report, DHS has demonstrated significant 
and constant progress. When the last High Risk List was issued in 2013, GAO narrowed this High Risk 
List category significantly. Now titled “Strengthening Department of Homeland Security Management 
Functions,” GAO stated that DHS’s approach, “if implemeiiled and sustained, provides a path :for DHS 
to be removed from GAO’s High Risk List.” 

Throughout our first year at DHS, Secretary Johnson and I have committed ourselves fully to making 
meaningful progress in addressing this High Risk area, with the ultimate goal of removal from the high 
risk designation. We have taken extraordinary steps in the areas of financial management, human 
capital management, acqui.sitions, and information technology with that goal in mind, including receipt 
of a clean audit opinion of the Department’s financial statements, a significant accomplishment. We 
developed monthly action plans with measurable targets to address GAO recommendations, and we 
share tho,se action plans regularly with GAO. The number of open GAO recommendations to DHS has 
decreased steadily. 
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We have enhanced, strengthened, and integrated our management iines-of-business not simply because 
of the High Risk list, but also because it is critical to the Secretary's vision embodied in the 
Department’s Unity of Effort initiative, which aims to execute our missions in such a way tliat best 
utilizes our limited resources. 


Financial Management 


In FY 2014, DHS earned a clean audit opinion on the agency’s financial statements for the second 
consecutive year. Sustaining a clean audit opinion is the result of strong policies, procedures, and 
controls that are in place throughout the financial management community at DHS. The audit findings 
demonstrate that DHS can accurately account for and report on its resources. DHS also significantly 
improved internal controls by completing substantial property accounting remediation at the U.S. Coast 
Guard. /\t ICE and USCIS, the audit found improved information technology controls and removed that 
issue from the report. T'his positions DHS for a clean internal control audit in FY 2016. 

Financial systems modernization is critical to sustaining progress in maturing financial management at 
DHS and maintaining a clean audit opinion. Modernizing will help address areas such as systematic 
internal control weakne.sses, audit readiness and sustainability, and improve the Department’s ability to 
effectively and efficiently process and report financial data. In addition, Components comply with 
standard operating procedures on managing financial systems modernization (c.g. schedule, monitoring 
and mitigating risk, capturing lessons learned for future use. 

Moving forward, DHS will continue to make improvements, identify and commit resources to remediate 
remaining material weaknesses, and continue to fully modernize financial systems to improve data 
reliability, availability, and accuracy. 

Human Capital Management 

Our dedicated employees are the backbone of our organization and I have committed a significant 
amount of time and energy to engage with DHS employees. For example, 1 have participated in several 
focus groups with employees to engage in honest conversations about what is working across the 
■Department and what areas can realistically be improved. One priority area is to ensure that our hiring, 
promotion and performance management processes are fair and transparent. 1 will continue to engage 
with both our employees and managers to directly address and remediate morale issues, 

GAO has provided positive feedback on the latest Human Capital Strategic Plan, which unifies the 
Department on critical goals, outcomes and measures to continuously improve the way we hire, develop 
and reward our w'orkforce. This Plan serves as the cornerstone to drive success across the Department. 

Acquisition Program Management 
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While we have made progress in the acquisition area, we know that we have much work yet to do. We 
are encouraged by the maturation of the reconstituted Joint Requirements Council as it works to assess 
joint requirements for .several investment portfolios, which include: information-based screening and 
vetting, aviation commonality, information sharing, chemical-biological-radiological-niiclear programs, 
and cybersecurity efforts. In the past year, we have improved acquisition oversight by solidifying the 
Component Acquisition Executive structure, ensuring that qualification and training standards are clear 
for program managers witliin the Components. 

To ensure that all of our acquisition programs are adequately staffed to support the Departmenf s 
mission, w'e now' require all Component Acquisition Executives and major programs to submit staffing 
plans and three-year workforce planning documentation. Additionally, we continue to cultivate talent 
through the Acquisition Professional Career Program as 60 students graduated in 2014 and they have 
been placed throughout Components in both contracting and program related positions. These interns 
are home-grown talent and are positioned to become the acquisition leaders of the future. 

The Department’s Acquisition Review Board increased the frequency of its program reviews in FY 
20 1 4, averaging more than one major program review per month. In FY 20 1 4, we prepared a new 
Systems Engineering Lifecycle liustruction and Guidebook, and our Director of Operational Test and 
Evaluation initiated a project to improve the timing, quality, and content of program Test and Evaluation 
Master Plans. Also, as a proactive measure to identify and address issues before they become critical, 
DHS implemented a monthly High-Visibility Briefing of the Department’s major acquisition programs 
for the Chief Acquisition Officer (CAO) and Acquisition Review Board members, in FY 2015, we will 
fiirther strengthen acquisition oversight by implementing more effective metrics to track policy 
compliance, program health, cost, schedule, and performance of major programs. This additional layer 
of oversight will enable the Department to apply data-driven evaluations to identify weaknesses and 
apply targeted remediation. 

Information Technology Management 

The Department is committed to strengthening information technology management and has either fully 
or mostly addressed four of six information technology management outcomes. For example, our 
continued commitment to strengthening Information Technology security is reflected by a compliance 
rate of 95% for the provisions of the F'ederal Information Security Management Act. In addition, we 
have adopted the continuous diagnostics and mitigation approach, which will allow Components to 
identify, fix, and report their most critical cyber problems on a near-real lime basis. Lastly, we 
implemented intrusion monitoring to help the Department assess the overall effectiveness of .specific 
network defense systems. 

Strong Information Technoiogy governance structures and processes ensure more efficient and effective 
management of technology investments. By aligning our technology investments to capability-based 
portfolios, establishing five new program-level Executive Steering Committees, the Department has 
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strengthened its governance structure. Additionally, we conducted our annual portfolio reviews, which 
informed budget development for FY 2016. 

Further, the Management Cube, a new Department-wide business intelligence tool developed by our 
dedicated DHS employees, is beginning to be used to inform critical decisions. This tool incorporates 
business data into a common platform, enabling analysis that links dollars, people, assets, contracts, and 
programs. We will work unceasingly in the coming year to build upon this progress. 

National Flood Insurance Program 

The National Flood Insurance Program (NFIP) is a key component of the Federal Government’s efforts 
to limit the damage and financial impact of floods; however, it will not generate sufficient revenues to 
repay the billions of dollars borrowed from the U.S. Department of the Treasury to cover claims from 
the 2005 huiricanes or future catastrophic losses. The lack of sufficient revenues highlights structural 
weaknesses in how the program is funded. The Federal Emergency Management Agency (FEMA), 
within DFIS, is responsible for managing the NFIP. FEMA has taken steps to remediate weaknesses in 
NFIP management and operations, including financial reporting processes and internal controls and 
oversight of contractors that placed the program at risk. Additionally, Hazard Mitigation Assistance 
grants provide funding to enhance a community’s resilience to Hooding. .And finally, the President’s 
Climate Action Plan (June 2013) required agencies to revise their flood risk standards. To further this 
goal, an Executive Order Establishing a Federal Flood Risk Management Standard was announced 
January 30, 2015. While not directly linked to the NFIP, it will result in structures in flood-prone areas 
being more resilient. This will help strengthen the overall solvency of the program . 

FEMA continues to make progress on the National Flood Insurance Program and to address structural 
and operating challenges. The Biggert- Waters Flood Insurance Reform Act of 2012 (Biggert-Waters 
Act) and the Homeowner Flood Insurance Affordability Act of 2014 (HFIAA) introduced many changes 
to NFIP, In particular, the Biggert-Waters Act eliminated subsidized premium rates for several types of 
properties. As mandated by the Biggert-Waters Act, FEM.A has begun phasing out subsidies on policies 
for residential properties that are not primary residences, and single-family properties with severe 
repetitive losses. However, in March 2014, Congrc.ss passed and the President signed into law HFIAA, 
which alte.red portions of the Biggert-Waters Act. FEMA has worked to implement sections of the 
Homeowner Affordability Act that repealed certain rale increases and set new requirements for rate 
increases and continues to examine affordability tssue,s through the Affordability Study required by both 
Acts. 


FEMA continues to W'ork closely with GAO to address the operating challenges identified in GAO’s 
recommendations to improve management and operations. GAO undertook several engagements in 201 4 
that resulted in recommendations, that when implemented will improve FEMA’s oversight of the NFIP. 
FEMA already implemented several recommendations and looks forw'ard to working with GAO to close 
these recommendations. 
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Establishing Effective Mechanisms for Sharing and Managing Terrorism-Related Information to 
Protect the Homeland 

The Department of Homeland Security (DIIS) continues to be committed to its obligations to share 
information with the Intelligence Community (IC) partners for national security purposes and to ensure 
that the data shared is appropriately used, maintained, and protected by our IC partners. To that end, 
DUS finalized its bulk data sharing policy for counterterrorism purposes, DHS identified a framework 
of six factors (consisting of both data sensitivity and operational factors) to be considered in determining 
periods of retention by the IC of bulk-ingested DHS datasets. This framework was the cornerstone for 
the renegotiation of DHS datasets concerning the National Counterterrorism Center (NCTC) revised 
Attorney General Guidelines. DHS, in partnership with NCTC, was able to complete Memoranda of 
Agreements for the follow'ing DHS datasets: 

• Advanced Passenger Information System (APIS); 

• Refugees, Asylum, and Parole System (RAPS); 

• Arrival and Departure Information System (ADIS); and 

• Electronic System for Travel Authorization (ESTA). 

DHS is also championing the DHS Data Framework, a .scalable technology program; the pathway to 
building better data aggregation and information sharing systems, and incorporating privacy, civil rights 
and civil liberties protections into the data and system architecture, while enabling better controlled, 
more effective, and more efficient use of existing homeland security-related information across the DHS 
enterprise and with other U.S. Government partners, as appropriate, 

DHS continues to mature its information sharing network with our State, Local, Tribal, and Temtorial 
(SLTT) partners. In support of these information sharing efforts, DHS Office of Intelligence and 
Analysis (I&A) continues to leverage the Homeland Security Infomiation Network (HSIN) as its 
primary platform to share unclassified information with these partners, and facilitate real-time 
collaboration on a host of topics ranging from joint production to the provision of real-time situational 
awareness. In particular, I&A shares unclassified intelligence infonnation with SLTT partners via the 
HSIN-Intclllgence (HSIN-Intel) community of interest. HSIN-Intel provides intelligence professionals 
with a secure platform for effective and efficient collaboration, access to data, analytical exchange, and 
timely information sharing and situational awareness. Additionally, 1& A manages the joint DHS and 
Federal Bureau of Investigation (FBI) Countering Violent Extremism and Active Shooter (CVE-AS) 
Web Portal. This portal, also located within HSIN, provides users and training practitioners with 
accurate, appropriate, and relevant CVE and AS training development re,sourcc.s, subject matter expert 
contact information, and information on outreach and engagement initiatives. 

The resources provide a great example of the tools DHS has implemented to minimize gaps in sharing 
relevant and timely information and intelligence concerning threats to the homeland with its customers. 

Protecting the Federal Government’s Information Systems and the Nation’s Cyber Critical 
Infrastructures 
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The Departmcnl has made signiilcant progress in improving its ability to protect against cyber threats by 
advancing its cyber analysis and warning capabilities, acquiring enhanced analytical and technical 
capabilities, developing strategies for hiring and retaining highly qualified cyber analysts, and 
strengthening the effectiveness of its public-private sector partnerships in securing cyber critical 
infrastructure. 


Executive Order 13636 on Cybersecurity' and Presidential Policy Directive 21 on Critical Infrastructure 
Security and Resilience takes a whoic-of-govemment approach and reinforces the need for holistic 
thinking about security and risk management across critical infrastructure sectors. More specifically, the 
whole-of-government approach is a result of the Executive Order directing the Secretary of Homeland 
Security to establish a consultative process to coordinate improvements to the cybersecurity of critical 
infrastructure (Sec. 6). This approach also resulted in the interagency taskforce, led by DHS, to include 
representatives from Sector-Specific Agencies, other relevant agencies, independent regulatory agencies, 
the law enforcement community, the National Institute of Standards and Technology, and the 
Intelligence Community. DHS met each of its deadlines under these directives, including publication of 
the revised National Infrastructure Protection Plan and establishment of the Critical Infrastructure Cyber 
Community (C-Cubed) Voluntary Program. 

Since the beginning of Fiscal Year 2014, DHS has closed 1 1 Government Accountability Office (GAO) 
and 18 Office of Inspector General (OIG) recommendations directed at DMS’s National Protection and 
Programs Directorate’s Office of Cybersecurity and Communications. Included in those 
recommendations. DHS closed out OIG-1 3-95, DHS Can Take Actions to Address Its Additional 
Cyhersecurity Responsibilities, which was highlighted in the 2014 GAO High-Risk Series Discussion 
Draft, DEIS has also implemented all recommendation issued in OIG-14-52, Implementation Status of 
EINSTEIN 3 Accelerated (E?A) and 010-14-119, Implementation Status of Enhanced Cyhersecurity 
Services (ECS). While recommendations remain open, DHS has demonstrated progress in implementing 
recommendations and working with GAO and OIG to ensure a mutually beneficial partnership. 

Conclusion 

The women and men of the Department of Homeland Security dedicate themselves each day to 
improving our Department, and making important advances on the areas enumerated in GAO’s High 
Risk List, The progress we have made as a Department are a direct result of these efforts. I pledge to 
this Committee our resolve that we will re-commit ourselves to working closely with GAO and re- 
doubling our effort.s to make progress on these important areas, in order to make DHS eligible for 
removal from the GAO High Risk List. 
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Table 1 : Status of Actions Directed to Congress and the Executive Branch In Our 2011-2014 Annual Reports, as of November 
19, 2014 


Executive branch* Congress® Grand totals 


Status 

Number of 
actions 

Percentage 

Number of 
actions 

Percentage 

Total number 
of actions 

Ovoral! 

percentage 

Addressed 

lie 

30% 

19 

26% 

135 

29% 

Partially addressed 

189 

49 

13 

18 

202 

44 

Not addressed 

66 

1? 

37 

50 

103 

22 

Consolidated or other 

13 

3- 

5 

7 

18 

4 

SourcB; GAO, 1 GAO-15.4-tOT 


Note; In assessing actions suggested for Congress, we applied the following criteria; "addressed" 
means relevant le^slation has be^ enacted and addresses all aspects of the action needed; 
“partially addressed" means a r^evant bill has passed a committee, the House of Representatives, or 
Ihe Senate, or relevant legislaBon has been enacted but only addressed part of the aclion needed; 
and "not addressed" means a bill may have been Introducsd but did not pass out of a committee, or 
no relevant te^slatton was fribcduced. In assessing actions suggested for !ho executive brancti, we 
applied the foilowir^ criteria: "addressed* means implementation of the action needed was 
completed; ‘^jarBaBy addressed” means the action needed was In development, or started but not yet 
complofad; and 'not addressed" means the administration, the agencies, or both made minimal or no 
progress toward BnfBementing fte action needed. Actions included in "consolidated or other" were not 
assessed due to addiUon^ wori< or other infomiation we considered. 

“Executive branch agencies toc^ steps that addressed four actions directed to Congress. 

^Congress took steps that fully addre.ssed one aclion and partially addressed another action directed 
to executive branc^i ag^des. 
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Post-Hearing Questions for the Record 
Submitted to the Honorable Gene L. Dodaro 

From Senator Joni Ernst 

“Risky Business: Examining GAO’s 2015 List of High Risk Government Programs” 

February 11, 2015 


1. Modernizing the U.S. Financial Regulatory System and the Federal Rote in 
Housing Finance 

a. From your review?, outside the legislative landscape, are there steps 
FHFA could be taking to improve the system? 


Our focus in this area has been on evaluating options for restructuring Fannie Mae and 
Freddie Mac (the enterprises) — which FHFA placed under conservatorship in 2008 — and 
the federal role in housing finance generally, in a 2009 report, we provided a framework 
for identifying trade-offs associated with options for revising the long-term structures of 
the enterprises.’ In a 2014 report, we provided a framework to help reveal the relative 
strengths and weaknesses of proposals to change the housing finance system and to 
identify what are likely to be significant trade-offs among competing goals and policies.^ 

In addition to facilitating any restructuring of the enterprises and the oversight of housing 
finance entities, it will be important for FHFA to follow through on key efforts it has under 
way to help improve the housing finance system. For example, in 2012, FHFA directed 
Fannie Mae and Freddie Mac (the enterprises) to develop a new mortgage securitization 
platform that would replace the enterprises’ proprietary systems and that could be used 
by multiple securities issuers, FHFA will need to continue to oversee this effort to ensure 
that remaining development and implementation challenges are addressed. In addition, 
FHFA has an ongoing initiative with Consumer Financial Protection Bureau (CFPB) to 
build a national mortgage database. Completing this effort is important because the 
database could be a useful tool for examining the effect of reforms to the housing 
finance system. Further, under FHFA’s direction, the enterprises have executed 
transactions that share single-family mortgage credit risk with private market 
participants. Because these transactions could help inform the development of 
standards for future mortgage securitizations. FHFA will need to follow through on efforts 
to assess the merits of the transactions. We will continue to monitor the actions of FHFA 
and other federal agencies with key roles and responsibilities in the housing finance 
system. 


b. You referenced that “FHA’s Mutual Mortgage Insurance Fund has been 
out of compliance with its statutory 2-percent capital requirement since 


’GAO, Fannie Mae and Freddie Mac: Analysis of Options for Revising the Housing Enterprises' 
Long-term Structures, GAO-09-782 (Washington, D.C.: Sep, 10, 2009). 

^GAO, Housing Finance System: A Framework for Assessing Potential Changes, GAO-15-131 
(Washington, D.C,; Oct. 7, 2014), 
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fiscal year 2009.” What recommendations do you have to ensure 
compliance? Should there be consequences for not complying? Are 
their actions FHA could be taking outside of legislative action to 
improve this ratio? 


In a 2010 report on FHA’s financial condition, we noted that the Omnibus Budget 
Reconciliation Act of 1 990 requires FHA to maintain a capital ratio of at least 2 
percent “at all times” after November 2000 but does not specify time frames for 
reattaining a 2 percent ratio should it fall below that level. * We concluded that in 
the absence of more explicit directions, the priority that FHA should place on 
restoring the capital ratio versus its operational goals (for example, providing 
mortgage insurance to traditionally underserved borrowers) may be unclear. As a 
result, we suggested that Congress consider establishing a minimum time frame 
for restoring the capital ratio to 2 percent should the ratio fall below that level, 
taking into account FHA's statutory operational goals and role in supporting the 
mortgage market during periods of economic stress." Additionally, in 2013, we 
suggested that Congress consider requiring FHA to submit a capital restoration 
plan whenever the capital ratio falls below 2 percent in order to strengthen FHA 
accountability for complying with the capital requirement.® 

Further, we previously recommended that Congress or FHA specify the 
economic conditions that FHA’s insurance fund would be expected to withstand 
without drawing on the Treasury.® FHA has not implemented this 
recommendation, but has adopted a methodology known as stochastic 
simulation to better incorporate the variability of economic variables into 
estimates of the insurance fund’s capital ratio. While we have not recommended 
specific actions that FHA should take to improve the capital ratio, in a 2013 
report, we examined a number of proposed options to help improve FHA’s long- 
term viability, including adjustments to the terms and conditions of FHA’s 
insurance products and changes to FHA’s structure and powers.^ 


®GAO, Mortgage Financing: Opportunities to Enhance Management and Oversight of FHA’s 
Financial Condition, GAO-10-827R (Washington, D.C,: Sept. 14, 2010), 

^Legislation that would have established a minimum time frame was introduced in the 112’” 
Congress (2011-2012) but was not enacted. See FHA Bailout Protection Act of 201 1 (S. 1997). 
^GAO, FHA Mortgage Insurance: Applicability of Industry Requirements Is Limited, but Certain 
Features Could Enhance Oversight. GAO-13-722 (Washington, D.C.: Sep. 9, 2013). Legislation 
that would have required FHA to develop an emergency capital plan was introduced in 2012 and 
2013 but was not enacted. 

’’GAO, Mortgage Financing: FHA 's Fund Has Grown, but Options for Drawing on the Fund Have 
Uncertain Outcomes, GAO-01-460 (Washington, D.C.: Feb. 28, 2001). Legislation consistent with 
our recommendation was introduced in the 107th Congress (2001-2002) but was not enacted. 
See Housing Affordability for America Act of 2002 (H. R, 3995). 

^GAO, Federal Housing Administration: Analysis of Options for Modifying Its Products, Market 
Presence, and Powers, GAO-13-682 (Washington, D.C.: Sept. 9, 2013), 
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c. Are current policies at FHFA that aim to expand the roie of the federal 
government in housing finance exacerbating the overall risk profile? 


We have not evaluated the potential impact of FHFA's current regulatory policies on 
overall risks. However, we have previously indicated that interactions between the 
different parts of the housing finance system need to be considered in assessing risks to 
the federal government. For example, in our 2013 High-Risk Update, we stated that 
efforts to reduce the market presence of the enterprises could shift some borrowers 
currently served by that market segment to FHA.® (Conversely, FHFA policies with the 
potential to expand the enterprises’ market presence could shift some borrowers away 
from FHA.) We further noted that regulations required by the Dodd-Frank Wall Street 
Reform and Consumer Protection Act will have major implications for the size and 
borrower composition of the private-label market for mortgage-backed securities, which, 
in turn could affect the risk exposure of the enterprises and FHA. Additionally, in a 2014 
report, we discussed the view of some stakeholders that reforming one part of the 
housing finance system, such as the secondary market, could create additional risks 
elsewhere in the system, such as in the primary market.® 


2. Managing Federal Real Property 

a. Does GAO have recommendations on how to make the disposal process 
more efficient, less-time consuming and less costly? Is it your 
understanding that the Office of Management and Budget (OMB) wili 
include these recommendations in their upcoming national real property 
strategy? 


We have made a number of recommendations to improve the identification and disposal 
of unneeded federal real property. In recent years, our focus has been on improving 
planning and real property data. Specifically, the Office of Managment and Budget 
(OMB), in conjunction with land-holding agencies, could improve its capacity by 
implementing our 2012 recommendation to develop a strategic plan for managing 
excess and underutilized real property.’® We also continue to believe that consistent 
and accurate data on federal real property are necessary for the federal government to 
effectively manage real property. However, we found in 2012 that the federal real 
property database may not be a useful tool for describing the nature, use, and extent of 
excess and underutilized federal real property.” We recommended that the General 


®GAO, High-Risk Series: An Update, GAO-13-283 (Washington, D.C.: February 2013). 

‘■’GAO, Housing Finance System: A Framework for Assessing Potential Changes, GAO-1 5-131 (Washington, 
D.C.: Oct. 7, 2014). 

’°GAO, Federal Real Property: National Strategy and Better Data Needed to Improve Management of 
Excess and Underutilized Property, GAO-12-645 (Washington, D.C,: Jun, 20, 2012). 

” GAO- 12-645. 
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Services Administration's (GSA) work with other land-holding agencies to improve 
governmentwide real property data, consistent with sound data collection practices, so 
that the data collected are sufficiently complete, accurate, and consistent. OMB 
released the National Strategy for the Efficient Use of Real Property on March 25, 2015. 
The strategy lays out the Administration’s plans to freeze growth in inventory, measure 
performance through data-driven decision making, reduce the size of the inventory 
through consolidation, co-location, and disposal of properties. We will thoroughly review 
the plan and its implementation. 

b. Your report states, “The Federal government continues to rely heavily on 
teasing of properties where it would be more cost efficient for the federal 
government to own. ..in 2013 we found that high-value leases account for 
over one third of GSA’s annual rent paid to private sector landlord and 
more than a quarter of the total lease square feet while representing just 3 
percent of GSA leases.” If it is more cost efficient to own a property, why 
are agencies continuing to rely on leasing? 


We have found that operating leases are appropriate for some real property 
requirements, such as those with short-term needs. However, GSA officials said 
that most of the high-value leases consist of long-term, relatively stable, mission- 
central needs for federal agencies — space needs that in many cases are likely to 
exist for longer than 20 years— and that in these cases, ownership is the most 
cost-effective solution over time. GSA officials stated that limited funding for its 
capital program has given GSA no choice but to continue to lease space for 
these government needs. Budget scoring rules require that the full cost of a 
capital purchase must be recorded in the year in which the budget authority is to 
be made available. In contrast, because operating leases are intended for short- 
term needs, only the amount needed to cover the first year’s rent and any 
cancellation costs need to be recorded in the budget in that year. We have also 
found that the lack of upfront capital for reconfiguration and renovation also 
creates challenges for the consolidation from privately-leased space into 
underutilized federally-owned space. 


c. In 2012, the Acting Director of OMB, Jeffrey Zients, issued a 
memorandum stating that “agencies shall not increase the size of their 
civilian real estate inventory” and “any acquisition of new federal building 
space. ..that increases an agency’s total square footage of civilian property 
must be offset through consolidation, co-location, or disposal of space 
from the inventory of that agency.” To your knowledge, has this guideline 
been followed? 


’^GAO, Capital Financing: Alternative Approaches to Budgeting for Federal Real Property, GAO-14-239 
{Washington, D.C.: Mar, 12, 2014), 
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To date, a lack of reliable real property data makes the answer to this question 
unclear; in 2015 we examined data from four of the six agencies that made the 
largest reductions in the first year of Freeze the Footprint reporting and found the 
data were not reliable, and we found that some of the largest reductions were 
overstated. In addition, OMB reported that 9 of 24 agencies saw a net increase 
in square footage between FY 2012 and FY2013, the only year of Freeze the 
Footprint reporting available to date. However, agency officials told us that some 
of the changes impacting the results of the first year of Freeze the Footprint 
policy were the result of efforts underway before the policy began. Officials at 
each of the four agencies we interviewed also said, however, that the Freeze the 
Footprint Policy is an incentive to reduce office and warehouse space going 
forward. 


d. in your report you also mention that much of the data and results 

generated from the Freeze the Footprint policy were “not reliable” and that 
results in many agencies were “overstated.” Understanding that mistakes 
happen or that assumptions can be misleading, are there consequences for 
agencies that provide false or inaccurate information on real property and 
fail to follow the guidance from the Federal Rea! Property Council? Should 
there be incentives to encourage the disposal of excess or underutilized 
property? 


In our review, we did not find any circumstances in which an agency had 
knowingly provided false or inaccurate information. Rather, the overstated 
reductions in square footage we identified were due to factors including the 
timing of when the reporting baseline was set, the categorization of space to 
another use, the correction of data errors, or the transfer of properties to GSA. 
Additionally, we found in past work that the current definitions of certain data 
elements could perpetuate confusion regarding the nature of federal government 
properties. Although some agency officials have told us during prior reviews that 
agency disposal costs can outweigh the financial benefits of property disposal 
and that limited budgetary resources create a disincentive to property disposal, 
property disposal carries with it the ongoing benefit of avoiding costs to operate, 
maintain, and secure unneeded real property assets. The consequences of 
unreliable data are significant: government managers are unable to effectively 
manage real property or measure the effectiveness of reforms, such as the 
Freeze the Footprint initiative. 


e. Does the agency have an accurate figure on how much money the 
government is wasting in underutilized federal real property? 


’®GAO, High-Risk Series: An Update, GAO-15-290 (Washington. D.C.: Feb, 11, 2015). 
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We have not been able to estimate this number because of reliability issues with 
the federal government’s real property data, in our 2012 report, we found that 
the Federal Real Property Council — an association of federal land-holding 
agencies— has not followed sound data collection practices in designing and 
maintaining the governmentwide real property database, raising concern that the 
database is not a useful tool for describing the nature, use, and extent of excess 
and underutilized federal real property. For example, we found that the agencies 
we reviewed did not report property initialization consistently. Specifically, we 
found utilization data inconsistencies or inaccuracies for properties at 19 of the 
26 federal sites we visited. For example, we found two buildings at a U.S. 
Department of Agriculture site that were listed as “utilized" from 2009 to 2010 but 
were in fact vacant. 


2. DOD Contract Management 

a. In your report you state, “DOD has also completed competency 
assessment that identified the current skills and capabilities of the 
acquisition workforce and helped identify areas needing further 
management attention. In that regard, in areas such as cost 
estimation and systems engineering, our work found that DOD may 
not have adequate resources to fully implement recent weapon 
system reform initiatives.” Please elaborate on these specific 
weapon system reforms that are at risk. In addition, can you provide 
information on this area’s current capabilities? 


The Weapon Systems Acquisition Reform Act of 2009 established new offices within the 
Office of the Secretary of Defense to, among other things, oversee acquisition program 
office efforts related to developmental testing, systems engineering, and cost estimating, 
and serve as an advisor to the Under Secretary of Defense for Acquisition, Technology 
and Logistics on these activities. We reported in December 2012 that leaders from the 
Developmental Test and Evaluation and the Cost Assessment and Performance 
Evaluation offices told us that they had implemented most of the fundamental Reform 
Act provisions, but they had to limit their activities to a portion of acquisition programs in 
their portfolios due to resource constraints.” Thus, it was doubtful that they could 
expand the scope of their activities to include more weapon acquisition programs at 
current staffing levels. For example, 

» The Developmental Test and Evaluation Office had to be selective in its level of 
oversight of acquisition programs because office staffing, which included about 


‘^GAO, Weapons Acquisition Reform: Reform Act Is Helping DOD Acquisition Programs Reduce Risk, but 
Implementation Challenges Remain, GAO-13-103 (Washington, D.C.: Dec. 14, 2012). 
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70 government and contractor personnel, could not adequately cover a portfolio 
of over 200 acquisition programs, according to its Deputy Assistant Secretary, 
The office had dropped virtually ail but the largest programs from its oversight list 
and eliminated oversight of some major automated information systems. 

• Cost Assessment and Performance Evaluation officials estimated that its cost 
assessment division would need to double in size to meet the Reform Act’s 
requirements. However, soon after the Reform Act was enacted, budgetary 
constraints limited the expansion of the cost estimating workforce to about 25 
percent of the necessary growth. Officials from that office stated that its cost 
analysis staffing at the time of our review was not adequate to meet its mission of 
improving the analytical skills of the defense cost estimating workforce, issuing 
policy, and providing sound and unbiased cost and schedule estimates. The 
office had delegated its independent cost estimating responsibility for most major 
automated information systems to the military services and some guidance had 
yet to be issued. 

• The Systems Engineering office was also struggling in some regards. For 
example, according to its Deputy Assistant Secretary, the Systems Engineering 
office was continuously challenged to maintain the high caliber, qualified 
personnel required to provide assistance to and oversight of its portfolio of over 
200 acquisition programs. 


We also reported that it was unclear whether the services had a sufficient number of 
qualified personnel to conduct systems engineering and test and evaluation activities. 
For example, the Deputy Assistant Secretary for Systems Engineering reported to 
Congress in March 2012 that the Army has reduced its systems engineering workforce 
growth plan as compared to the plan reported in March 201 1 , and that conlractor-to- 
civilian conversions have been suspended. In addition, the Deputy Assistant Secretary 
believed a prolonged hiring freeze in the Air Force could potentially create new 
experience gaps in the workforce. 

Statistics provided by the Department of Defense’s (DOD) Human Capital Initiative office 
show that as of the end of fiscal year 2014, the engineering and business career fields, 
which include the systems engineering and cost estimating workforces, respectively, 
have both increased in size since 2008. Specifically, between fiscal years 2008 and 
2014, the engineering career field grew from 34,537 to 39,242, a 14 percent increase; 
and the business career field grew from 7,085 to 7,451 , a 5 percent increase. We are 
conducting a review of DOD’s acquisition workforce to determine if there are any skill or 
capability gaps in these areas. 


b. Your report also mentions that DOD has delayed issuance of a strategic plan 
specific to its acquisition workforce and has not issued its biennial plan since 
April 2010. What is the reasoning for this delay? 
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We are mandated to review and report on DOD’s acquisition workforce plan within 1 80 
days of its issuance. We have been in contact with DOD's Human Capital Initiatives 
Office since its previous report was issued in April 2010, DOD had planned to issue an 
updated strategic workforce plan for the acquisition workforce in 2012, but has not yet 
done so, in part, according to DOD, because of the uncertainty regarding future budgets. 
We met with the newly named Director of that office in January and March 201 5 as part 
of an ongoing acquisition workforce review. The Director is aware of the reporting 
requirement, but it remains unclear when DOD will issue the biennial plan. 


c. In regards to Operational Contract Support, you referenced a 2012 study 
that found DOD was short about 70 positions related to civilian operational 
contract support analysts and planners. To the best of your knowledge 
has DOD been successful in completing its contract support without these 
70 positions? 

Our prior work identified a number of challenges with regard to planning for operational 
contract support (OCS) that could be due in part or exacerbated by the shortages of 
civilian OCS analysts and planners that was highlighted in DOD’s 2012 OCS Manpower 
Study.’'® For example, in February 2013, we found that while the Defense Logistics 
Agency, at the request of the combatant commands, has provided analysts with planning 
expertise to aid combatant commands in integrating OCS into their operations planning, 
the combatant commands’ military service components have not been provided such 
expertise to aid them in meeting their OCS planning requirements. ''® Without this 
expertise, we found that component planners are limited in their ability to integrate OCS 
into their plans to support combatant command requirements and, in some cases, are 
unaware of the overall requirements to integrate OCS into their planning as directed by 
the combatant commander. As a result, the components face difficulties incorporating 
OCS considerations into their planning efforts. This level of planning is essential since 
components generally identify and provide the resources necessary to support the 
combatant command's requirements in order to accomplish the mission of the specific 
operation. 

Further, DOD is implementing an OCS mission integrator concept. According to DOD 
documentation, the OCS mission integrators will be located at the combatant 
commands, joint task forces or selected components and will serve as an enduring, 
scalable cell, capable of providing the combatant command, subordinate joint force 


’’Department of Defense, Operational Contract Support Manpower Study (Sept. 2012). 

“■GAO, Warfighter Support: DOD Needs Additional Steps to Fully Integrate Operational Contract Support 
into Contingency Planning, GAO-13-212 (Washington, D.C.: Feb. 8, 2013), 
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commander, or selected service components a single lead for all major OCS efforts 
spanning current operations, future operations, and future planning." While it may prove 
challenging to establish OCS mission integrators in an era of constrained resources. 

U.S. Pacific Command has begun partnering with the Joint Staff (J-4) to implement the 
OCS mission integrator concept in an operational environment. 


'Department of Defense, Operational Contract Support Joint Concept (Oct. 7, 201 3). 
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Post-Hearing Questions for the Record 
Submitted to the Honorable Gene L. Dodaro 

From Senator Kelly Ayotte 

"Risky Business: Examining GAO's List of High Risk Government Programs" 

February 11, 2015 

1. According a December 2014 Inspector General report, the IRS estimates 
that $14.5 billion or 24 percent of all earned income tax credit (EITC) 
payments made in 2013 were paid in error. And for the additional child tax 
credit, the !G estimates that the potential improper payment rate for 2013 is 
between 25.2 and 30.5 percent, with potential improper payments totaling 
between $5.9 and $7.1 billion. Would expanded authority to allow the IRS to 
make corrections to tax returns when data obtained from the Department of 
Health and Human Services indicate the taxpayer's refundable credit claims 
are not valid help reduce improper payments? 


We have identified several situations where the Internal Revenue Service (IRS) 
can make corrections to tax returns using math error authority and have 
recommended broadening IRS’s authority, with appropriate safeguards against 
misuse of that authority.’® Expanding this authority could help IRS correct 
additional errors and avoid burdensome audits and taxpayer penalties. 


According to the Treasury Inspector General for Tax Administration (TIGTA). IRS 
has math error authority to address some erroneous claims, but additional 
authority to systematically disallow certain erroneous EITC claims with 
unsupported wages could reduce improper payments.’® Treasury has proposed 
expanding IRS authority to permit it to correct errors in cases where information 
provided by the taxpayer does not match information in government databases 
among other things. 


2. One area where GAO has identified significant savings is data center 

consolidation. The federal government operates thousands of underutilized 
data centers that, if consolidated, could save $5 billion, reduce electricity 
consumption, and better protect stored information. Last year Congress 
passed The Federal Data Center Consolidation Act of 2013 (S. 161 1), which 
required federal agencies to develop data center consolidation and 
optimization plans. However, legislation only accomplishes what it is 
supposed to if it is implemented correctly. The fact that infonnation 
technology acquisitions and management was just added to the High Risk 
List indicates that things might not be headed in the right direction, 
especially since over the past five years less than a quarter of 730 GAO 


’*For details, see GAO, Tax Filing Season: 2014 Performance Highlights the Need to Better Manage 
Taxpayer Sen/ice and Future Risks, GAO-15-163 (Washington, D.C.: Dec. 16, 2014). 

’’TIGTA, Existing Compliance Processes Win Not Reduce the Billions of Dollars in Improper Earned income 
Tax Credit and Additional Child Tax Credit Payments (Washington, D.C.: Sept. 29, 2014). 
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recommendations have been fully implemented. Like data center 
consolidations, are there other IT areas that would benefit from 
congressional mandates and reforms, or is administration implementation 
a chokepoint? 

In adding Improving the Management of IT Acquisitions and Operations to our 
High Risk List “ we highlight several critical areas that could improve the federal 
government's ability to effectively and efficiently invest in information technology 
(IT). These include, in addition to opportunities for greater savings from data 
center consolidation, the need for agencies to deliver capabilities incrementally 
(i.e,, in 12-month cycles) to reduce investment risk, improvements needed in the 
accuracy and reliability of investment cost and schedule data on the IT 
Dashboard, and the importance of identifying duplicative IT spending and 
achieving cost savings as part of the Office of Management and Budget’s (0MB) 
PortfolioStat initiative. Immediately preceding the addition of this new area to our 
High Risk List, in December 2014, Congress enacted federal information 
technology acquisition reform provisions as a part of the Carl Levin and Howard 
P. ‘Buck’ McKeon National Defense Authorization Act for Fiscal Year 2015.^' 

This legislation includes requirements that agencies report to 0MB on progress 
in consolidating federal data centers and achieving associated cost savings, and 
that 0MB provide guidance that requires agency chief information officers (CIO) 
to certify that IT acquisitions are adequately implementing incremental 
development and that cost and schedule performance are adequately reflected in 
evaluations of major IT investments. Further, the law requires that 0MB, in 
consultation with agency CIOs, implement a process to assist agencies in 
managing their IT portfolios, and that agencies other than the Department 
of Defense (which has separate requirements) ensure that CIOs have a 
significant role in programming and budgeting decisions. 

The new IT acquisition reform requirements codified in this legislation, if 
effectively and fully implemented, should further assist in addressing key issue 
areas identified in our high-risk report related to the management of IT 
investments. Going forward, OMB and federal agencies should expeditiously 
implement the requirements of the December 2014 statutory provisions. Doing so 
should (1) improve the transparency and management of IT acquisitions and 
operations across the government, and (2) strengthen the authority of chief 
information officers to provide needed direction and oversight. However, to help 
ensure that these improvements are achieved, congressional oversight of 
agencies' implementation efforts is essential. 

’“GAO, High Risk Series: An Update, GAO-15-290 (Washington, D.C.: Feb. 11, 2015). 

^’Carl Levin and Howard P. 'Buck' McKeon National Defense Authorization Act for Fiscal Year 2015, Pub. L. 

No. 113-291, Div. A. Title VIII, Subtitle D (Dec. 19, 2014). 
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3. Department of Defense secretary nominee Ash Carter has committed to 
DoD's current timelines for producing the necessary audit documents. Is 
GAO satisfied with the pace at which the Pentagon is resolving GAO 
recommendations in order to meet DoD auditability deadlines? 

We acknowledge the commitment of the Department of Defense’s (DOD) senior 
leadership to address its financial management challenges. Specifically, DOD continues 
its efforts to (1) implement the Financial Improvement and Audit Readiness (FIAR) Plan 
and the accompanying FIAR Guidance, which provides the standard methodology for 
DOD’s components to achieve audit readiness. (2) implement certain of its planned 
enterprise resource planning (ERP) systems to establish modern business information 
systems, and (3) develop training programs to build a skilled workforce. However, the 
department continues to face challenges in demonstrating progress. 

Our recent work has shown that DOD components are not effectively implementing the 
FIAR Guidance, which can affect not only the department’s ability to meet its September 
30, 2017, full financial statement auditability goal, but more importantly the department’s 
ability to make lasting improvements in its financial management capabilities. The FIAR 
Guidance requires DOD components to thoroughly assess key controls over their 
financial processes, develop corrective action plans, and verify that implementation of 
these plans successfully remediates system, process, and internal control deficiencies. 
However, components are asserting audit readiness before completing the key steps 
required by the FIAR Guidance methodology to ensure that effective processes, 
systems, and controls are in place for providing financial management information that is 
sufficient and reliable for day-to-day decision making. For example, we issued two 
reports to DOD in 2014 with recommendations aimed at improving the implementation of 
the FIAR Guidance with respect to the Army's budget execution and payments to 
contractors made by the Defense Finance and Accounting Service (DFAS). 

We reported that while the Army and DFAS had asserted audit readiness for the 
respective financial management processes, they had not effectively completed many of 
the procedures required by the FIAR Guidance, such as documentation of its end-to-end 
processes, adequate testing of key controls and documenting remediation of control 
deficiencies. While time frames are important for measuring progress, DOD should not 
lose sight of the ultimate goal of implementing lasting financial management reform to 
ensure that it can routinely generate reliable financial management and other information 
critical to decision making and effective operations. 

Although DOD has implemented some of our recommendations made in earlier reports 
on its FIAR effort, we have found that the department has not fully implemented many of 
our recommendations, including those regarding its ERPs and effectively managing risks 
related to its FIAR Plan. The ERP recommendations are of particular concern because 
DOD officials have stated that the successful implementation of these ERPs is critical to 


”An ERP solution is an automated system using commercial off-the-shelf software consisting of multiple, 
integrated functional modules that perform a variety of business-related tasks such as general ledger 
accounting, payroll, and supply chain management. 
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the department’s goal of producing auditable financial statements by September 2017. 
However, several ERPs are not yet functioning and DOD’s Office of Inspector General 
has noted that some ERPs wilt not be fully deployed by the department’s 2017 audit 
readiness deadline. Moreover, our recommendations pertaining to managing risk with 
respect to the FIAR Plan are important to help ensure its successful implementation. 
Without following this disciplined approach, DOD is at increased risk of not effectively 
achieving its audit readiness goals and lasting financial management reform. 


“DOD, Office of Inspector General, Inspector General’s Statement of Management and Performance 
Challenges forFY 2014. DOD Agency Financial Report for Fiscal Year 2014 (Washington, D.C.: November 
2014 ). 
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Post-Hearing Questions for the Record 
Submitted to Hon. Gene L. Dodaro 
From Senator Ben Sasse 

“Risky Business: Examining GAO’s List of High Risk Government Programs” 

Wednesday, February 11, 2015 


1 . During your testimony you noted how the Earned income Tax Credit (EiTC) 
program was susceptible to fraud for a variety of reasons. For instance, the 
Treasury inspector Genera! for Tax Administration (TIGTA) estimates that 
in fiscal year 2013, approximately 24 percent of aii EITC payments were 
made in error. 

a. According to the IRS, the agency paid out $5.8 billion in fraudulent 
returns in 2013. How does the agency distinguish between 
fraudulent claims and the tens of billions of dollars per year paid 
out? 

The Interna! Revenue Service (IRS) employs multiple approaches and 
tools to distinguish between Identity Theft (IDT) returns and legitimate 
returns. IRS’s efforts to combat IDT refund fraud occur at various stages 
of tax return processing (pre-refund) and continue after it issues tax 
refunds (post-refund). 

Pre-refund 

IDT and Fraud Filters. IRS uses computerized automatic checks that 
screen returns using characteristics that it has identified in previous IDT 
refund fraud schemes. The filters also search for clusters of returns with 
similar characteristics, such as the same bank account or address, which 
could indicate potential fraud. Suspicious returns are flagged and 
taxpayers are contacted to confirm their identities. 

Authenticating Taxpayer Identities. IRS has enhanced its 
authentication efforts to combat IDT refund fraud. For example, IRS 
provides Identity Protection Personal Identification Numbers (IP PIN) to 
past IDT victims who have confirmed their identities with IRS. IRS 
systems reject returns that lack IP PINs of taxpayers who have been 
issued an IP PIN. 

Post-refund 

Duplicate returns. Often, IRS becomes aware of IDT refund fraud when 
a taxpayer alerts IRS of an inability to electronically file (e-file) a tax 
return. Specifically, in cases where an identity thief has already e-filed a 
return using another taxpayer’s name and Taxpayer Identification 
Number — such as an SSN — IRS's e-file system will reject the second, 


hftp://www.treasury.gov/tigta/press/press_tigta-201 4-50.htm 
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duplicate return, thus preventing the legitimate taxpayer from filing. IRS 
officials are aware when the e-file system rejects returns; however, they 
do not know if the rejections are due to IDT refund fraud unless further 
investigation is conducted. 

Third-party leads. IRS receives third-party leads regarding suspected 
IDT refund fraud and other types of refund fraud through efforts including 
the External Leads Program and the Opt-ln Program. The External Leads 
Program involves third parties providing lead information to IRS. If iRS 
determines a questionable refund is fraudulent, it will request that the 
financial institution return the refund. The Opt-ln Program allows financial 
institutions to electronically reject suspicious refunds and return them to 
IRS, indicating why the institution is rejecting the refunds. 

Automated Underreporter (AUR) program. IRS also finds IDT refund 
fraud as part of the AUR program, which matches tax return data to 
information returns, such as Form W-2, These information returns are 
provided by third parties such as employers, financial institutions, and 
others. In many cases, IRS does not receive the information returns until 
well after receiving tax returns and processing refunds. In these types of 
cases, the legitimate taxpayer may not be aware of a stolen identity until 
after receiving a notice indicating that the income (or payment 
information) IRS has on file does not match the information reported on 
the tax return. 

Criminal investigations. IRS identifies IDT cases as part of its criminal 
investigations. 


b. Are any particular tax benefit programs, or types of programs, more 
vulnerable to fraud than another? 

In general, income and tax benefits that do not have third-party 
information reporting are more vulnerable to fraud. We have previously 
found that the extent to which individual taxpayers accurately report their 
income is related to the extent to which the income is reported to them 
and IRS by third parties or taxes on the income are withheld.^® For 
example, we have reported that for types of income for which there is little 
or no information reporting, such as business income, individual 
taxpayers tend to misreport over half of their income. In contrast, 
employers report most wages, salaries, and tip compensation to 
employees and IRS through Form W-2. Also, banks and other financial 
institutions provide information returns (Forms 1099) to account holders 
and IRS showing the taxpayers' annual income from some types of 
investments. Findings from IRS’s study of individual tax compliance 
indicate that nearly 99 percent of these types of income are accurately 
reported on individual tax returns. 


’^GAO, Tax Gap: Sources of Noncompliance and Strategies to Reduce It, GAO-12-651T (Washington, D.C.: 
Apr. 19, 2012). 


15 



164 


c. Is the EITC program susceptible to fraud? if so, why? 

We have highlighted persistent problems with improper EITC payments 
for years, and it is a factor underlying our continued designation of 
Enforcement of Tax Laws as a high-risk area.^® In fiscal year 2014, IRS 
reported program payments of $65,2 billion for the EITC^^ and estimated 
that 27.2 percent, or $17.7 billion, of these payments were improper,^® 

The estimated improper payment rate for EITC has remained relatively 
unchanged since fiscal year 2003 (the first year IRS had to report 
estimates of these payments to Congress), but the amount of improper 
EITC payments increased from an estimated $10.5 billion in fiscal year 
2003 to $17.7 billion in fiscal year 2014. 

As we have reported, a root cause of EITC noncompiiance is the self- 
determination of eligibility by taxpayers (or their preparers) combined with 
IRS’s limited ability to verify eligibility before payments (refunds) are 
issued. According to Treasury, EITC improper payments can be divided 
into two categories — authentication and verification,^® Authentication 
errors include errors associated with IRS’s inability to validate qualifying 
child requirements, taxpayers’ filing status, and EITC claims associated 
with complex or nontraditional living situations. Verification errors relate to 
IRS’s inability to identify individuals improperly reporting income to 
erroneously claim EITC amounts to which they are not entitled. 
Verification errors include underreporting and overreporting of income by 
wage earners as well as taxpayers who report that they are self- 
employed. Although the EITC program has been modified a number of 
times since its enactment in 1975 to reduce complexity and help improve 
the program's administration, complexity has remained a key factor 
contributing to improper payments in the program. 


“GAO, High-Risk Series: An Update, GAO-15-290 (Washington, D.C.: Feb. 11, 2015). 

®’EITC eligibility depends on an individual’s earned income. Credit amounts depend on the number of 
qualifying children who meet age, relationship, and residency tests. The credit gradually increases with 
income (the phase-in range), plateaus at a maximum amount (the plateau range), and then gradually 
decreases until it reaches zero (the phase-out range). 

®®EITC overpayments are the difference between the EITC amount claimed by the taxpayer on his or her 
return and the amount the taxpayer should have claimed. EITC underpayments are defined as the amount 
of EITC disallowed by IRS in processing that should have been allowed, 

®®Treasury Inspector General for Tax Administration, Existing Compliance Processes Will Not Reduce the 
Biilions of Dollars in Improper Earned Income Tax Credit and Additional Child Tax Credit Payments, 
Reference Number 2014-40-093 (Washington, D.C.: Sept. 29, 2014), 
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d. You mentioned that “reduced staffing” at the iRS has contributed to 
reduced tax enforcement. How many empSoyees does the IRS 
dedicated to tax enforcement? 

IRS’s enacted fiscal year 2015 enforcement appropriation funded 40,564 
full time equivalents (FTE). This accounts for almost half of IRS’s total 
82,203 FTE in fiscal year 2015, 

FTEs within IRS’s enforcement appropriation have declined by 6,797 from 
47,361 in fiscal year 2009 (actual) to 40,564 in fiscal year 2015 (enacted). 


e. Your testimony said the Internal Revenue Service (IRS) dedicates 
3,000 employees to detecting and preventing identity theft. What do 
these employees do and is it enough? 

Employees work to prevent refund fraud, investigate IDT-related crimes 
and help taxpayers who have been victimized by identity thieves. 

Given that IRS estimates that it paid $5.8 billion in refunds of the $30 
billion in attempted IDT refund fraud in filing season 2013, more effort is 
needed to combat the problem. In particular, IRS will need to focus on 
developing a robust pre-refund strategy because preventing fraudulent 
refunds is easier and more cost-effective than trying to recover refunds 
after they have been issued. Preventing IDT refund fraud could also 
allow IRS to reallocate FTEs dedicated to resolving IDT on tax accounts 
to other needs. 

We have reported on two potential tools (improved taxpayer 
authentication and pre-refund Form W-2 matching) that could prevent 
billions in IDT refund fraud; however these tools would have significant 
costs for taxpayers and IRS and would require substantial changes in tax 
administration.™ See Question 1h below for details on our 
recommendations related to taxpayer authentication and pre-refund Form 
W-2 matching. 


f. How many IRS employees are responsible for overseeing and 
enforcing the Patient Protection and Affordable Care Act? 

Under IRS’s fiscal year 2015 budget, approximately 1 ,200 FTEs are 
responsible for implementing the Patient Protection and Affordable Care 
Act. 


®GAO, Identity and Tax Fraud: Enhanced Authentication Could Combat Refund Fraud, but IRS Lacks an 
Estimate of Costs, Benefits and Risks, GAO.15-119 (Washington, D.C.: Jan, 20, 2015) and Identity Theft: 
Additional Actions Could Help IRS Combat the Large, Evolving Threat Of Refund Fraud, GAO-14-633 
(Washington, D.C.: Aug. 20, 2014). 
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g. If millions of additional people become eligible for EITC benefits as a 
result of the President’s executive actions on immigration, will the 
!RS need additional people to fight identify theft? 

At this time, we do not know how often the EITC is claimed on IDT 
returns, or if IDT returns claim the EITC more often than other types of tax 
credits. As part of an ongoing engagement, we will review the 
characteristics of IDT refund fraud, including the types of credits that were 
claimed. 


h. Why has the IRS not yet complied with GAO’s recommendations for 
reducing fraud and identity theft? 

IRS has implemented several of our prior recommendations, and agency 
officials have told us they are implementing outstanding 
recommendations from our recent reports. For example: 

• In November 2012, we recommended several improvements to IRS’s 
Refund Fraud and Identity Theft Global Report, which consolidates 
and tracks information about IDT incidents across multiple sources 
within IRS.^’ In June 2013, IRS updated the Global Report to improve 
the reliability of IDT information available to Congress and IRS 
management. 

• In August 2014, we recommended that IRS estimate the costs and 
benefits of pre-refund Form W-2 matching, including identifying the 
IRS systems that will need to be adjusted and providing information 
on other changes will be needed {such as delaying the start of the 
filing season or delaying refunds). In November 2014, IRS reported 
that it had convened an internal working group to address our 
recommendations and that it anticipated implementing our 
recommendations by July 2015. 

We also recommended that IRS improve feedback to third parties by 
(1) providing aggregated information on the success of external leads 
in identifying suspicious returns and emerging trends and (2) 
developing metrics to track external leads by the submitting third 
party. In November 2014, IRS reported that is developing a 
methodology for implementing our recommendations and anticipates 
implementing them by November 2015. 

• In January 2015, we recommended that IRS improve its IDT refund 
fraud estimates by (1) reporting the inherent imprecision and 
uncertainty of estimates and (2) documenting the underlying analysis 


’’GAO, Identity Theft: Total Extent of Refund Fraud Using Stolen Identities is Unknown, GAO-13-132T 
(Washington, D.C.: Nov. 29, 2012). 

’^^GAO, Identity Theft: Additional Actions Could Help IRS Combat the Large, Evolving Threat Of Refund 
Fraud, GAO-14-633 (Washington, D.C.; Aug. 20, 2014), 
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justifying cost-influencing assumptions.^^ We also recommended that 
IRS estimate the economic costs, benefits, and risks of possible 
options for taxpayer authentication, IRS agreed with our 
recommendations. We anticipate receiving IRS’s plan for 
implementing these recommendations in April 2015. 


^’GAO, Identity and Tax Fraud: Enhanced Authentication Could Combat Refund Fraud, but IRS Lacks an 
Estimate of Cosis^ Benefits and Risks, GAO-15-1 19 (Washington, D.C.: Jan. 20, 2015). 
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